CVE-2015-0734
published 2015-05-15CVE-2015-0734: Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.55%
72.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | email_security_appliance_firmware | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q48c-ghv4-w9vq: Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8
ghsa_unreviewed·2022-05-14
CVE-2015-0734 [MEDIUM] CWE-79 GHSA-q48c-ghv4-w9vq: Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
Cisco
Cisco Email Security Appliance Cross-Site Scripting Vulnerability
vendor_cisco·2015-05-14·CVSS 4.3
CVE-2015-0734 [MEDIUM] CWE-79 Cisco Email Security Appliance Cross-Site Scripting Vulnerability
Cisco Email Security Appliance Cross-Site Scripting Vulnerability
A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack.
The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker could exploit this vulnerability by intercepting the user packets and injecting malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.
Cisco has confirmed the vulnerability; however, software updates are not available.
To exploit the vulnerability, the attacker may provide a link that directs a user t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-05-15
Published