NetSight
IP …
medium4.3Public exploit code

CVE-2010-0440

Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.

Affected products

VendorProductAffected versions
CiscoSecure Desktop
before 3.5
CiscoAdaptive Security Appliance Software
from 8.1 before 8.1\(2.7\)
from 8.0 before 8.0\(5\)
from 8.2 before 8.2\(1\)

Weakness classification

CWE-79

References