XSS vulnerability in Cisco's online help system
In a security response, Cisco has released details of a cross-site scripting vulnerability in its online help, included in numerous Cisco software products. The bug lies in the search function, PreSearch.html / PreSearch.class, which fails to filter the content entered. Using a prepared link, an attacker could execute JavaScript in the user's web browser if the user follows the particular link. The vendor does not elucidate what the consequences of this might be for the relevant software.
Numerous products are affected, including the VPN client, IP Communicator, CallManager and Secure Access Control Server. The security response from Cisco provides a full overview. No update is available - Cisco suggests deleting or renaming the PreSearch.html or PreSearch.class files.
- Cross-Site Scripting Vulnerability in Online Help System, security response from Cisco
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
