Unscored severity · published May 26, 2014
CVE-2014-3266
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Security Manager · Cisco
through 4.6; 4.0; 4.0; 4.0.1; 4.0.1; 4.0.1; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3266
secunia.com
http://secunia.com/advisories/58923
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3266
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34340
www.securityfocus.com
http://www.securityfocus.com/bid/67569
More from Security Manager
9.8
CVE-2020-27131
Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands…
9.8
CVE-2020-27125
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system
9.8
CVE-2019-12630
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected…
9.1
CVE-2020-27130
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information
9.1
CVE-2019-1903
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition