Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-6436

Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.

Published

2016-10-06T10:59:17.570

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco hostscan_engine 3.0.08062 Yes
Application cisco hostscan_engine 3.0.08066 Yes
Application cisco hostscan_engine 3.1.01065 Yes
Application cisco hostscan_engine 3.1.02016 Yes
Application cisco hostscan_engine 3.1.02026 Yes
Application cisco hostscan_engine 3.1.02040 Yes
Application cisco hostscan_engine 3.1.02043 Yes
Application cisco hostscan_engine 3.1.03103 Yes
Application cisco hostscan_engine 3.1.03104 Yes
Application cisco hostscan_engine 3.1.04060 Yes
Application cisco hostscan_engine 3.1.04063 Yes
Application cisco hostscan_engine 3.1.04075 Yes
Application cisco hostscan_engine 3.1.04082 Yes
Application cisco hostscan_engine 3.1.05152 Yes
Application cisco hostscan_engine 3.1.05160 Yes
Application cisco hostscan_engine 3.1.05163 Yes
Application cisco hostscan_engine 3.1.05170 Yes
Application cisco hostscan_engine 3.1.05178 Yes
Application cisco hostscan_engine 3.1.05182 Yes
Application cisco hostscan_engine 3.1.05183 Yes
Application cisco hostscan_engine 3.1.06073 Yes
Application cisco hostscan_engine 3.1.14018 Yes
References