CVE

Id
19177  
CVE No.
CVE-2006-3073  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.  
Phase
Assigned (20060619)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
170952 19177 CVE-2006-3073 BUGTRAQ:20060608 SSL VPNs and security  View
170953 19177 CVE-2006-3073 URL:http://www.securityfocus.com/archive/1/436479/30/0/threaded  View
170954 19177 CVE-2006-3073 CISCO:20060613 WebVPN Cross-Site Scripting Vulnerability  View
170955 19177 CVE-2006-3073 URL:http://www.cisco.com/warp/public/707/cisco-sr-20060613-webvpn-xss.shtml  View
170956 19177 CVE-2006-3073 BID:18419  View
170957 19177 CVE-2006-3073 URL:http://www.securityfocus.com/bid/18419  View
170958 19177 CVE-2006-3073 VUPEN:ADV-2006-2331  View
170959 19177 CVE-2006-3073 URL:http://www.vupen.com/english/advisories/2006/2331  View
170960 19177 CVE-2006-3073 OSVDB:26453  View
170961 19177 CVE-2006-3073 URL:http://www.osvdb.org/26453  View
170962 19177 CVE-2006-3073 OSVDB:26454  View
170963 19177 CVE-2006-3073 URL:http://www.osvdb.org/26454  View
170964 19177 CVE-2006-3073 SECTRACK:1016252  View
170965 19177 CVE-2006-3073 URL:http://securitytracker.com/id?1016252  View
170966 19177 CVE-2006-3073 SECUNIA:20644  View
170967 19177 CVE-2006-3073 URL:http://secunia.com/advisories/20644  View
170968 19177 CVE-2006-3073 XF:cisco-webvpn-xss(27086)  View

Related JVN