Vulners
Lucene search
Cisco Ironport Email Security Virtual Appliance 8.0.0-671 XSS
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Centreon SQL Injection / Command Injection Vulnerability | 18 Oct 201400:00 | – | zdt |
 | Cisco AsyncOS Cross-Site Scripting Vulnerability | 9 Jun 201420:38 | – | cisco |
 | CVE-2014-3289 | 10 Jun 201410:00 | – | cve |
 | CVE-2014-3289 | 10 Jun 201410:00 | – | cvelist |
 | EUVD-2014-3302 | 7 Oct 202500:30 | – | euvd |
 | CVE-2014-3289 | 10 Jun 201411:19 | – | nvd |
 | Centreon SQL Injection / Command Injection | 18 Oct 201400:00 | – | packetstorm |
 | Cross site scripting | 10 Jun 201411:19 | – | prion |
 | Cisco Patches XSS Flaw in Security Appliances | 10 Jun 201410:47 | – | threatpost |
 | Cisco AsyncOS contains a reflected cross-site scripting (XSS) vulnerability | 10 Jun 201400:00 | – | cert |
10
`I. VULNERABILITY
-------------------------
Reflected XSS Attacks vulnerabilities in Cisco Ironport Email Security
Virtual Appliance Version: 8.0.0-671
II. BACKGROUND
-------------------------
Cisco Systems, Inc. is an American multinational corporation headquartered
in San Jose, California, that designs, manufactures, and sells networking
equipment.
III. DESCRIPTION
-------------------------
Has been detected a Reflected XSS vulnerability in Cisco Ironport Email
Security Virtual appliance.
The code injection is done through the parameter "date_range" in the page “
/monitor/reports/overview?printable=False&date_range”
IV. PROOF OF CONCEPT
-------------------------
The application does not validate the parameter “date_range” correctly.
https://ip_cisco_web_security/monitor/reports/overview?printabl
e=False&date_range=aaaa<script>alert(2)</script>
V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, , that allows the execution of arbitrary HTML/script code
to be executed in the context of the victim user's browser.
VI. SYSTEMS AFFECTED
-------------------------
Reflected XSS Attacks vulnerabilities in Cisco Ironport Email Security
Virtual Appliance Version: 8.0.0-671.
VII. SOLUTION
-------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3289
By William Costa
[email protected]
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Jun 2014 00:00Current
0.5Low risk
Vulners AI Score0.5
EPSS0.0066