CVE-2014-0663

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/101914
http://secunia.com/advisories/56382
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0663Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32403Vendor Advisory
http://www.securityfocus.com/bid/64773Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029595Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90232
http://osvdb.org/101914
http://secunia.com/advisories/56382
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0663Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32403Vendor Advisory
http://www.securityfocus.com/bid/64773Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029595Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90232

Timeline

Published: Jan 10, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-06646.8The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP c CVE-2014-06654.0The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, w CVE-2014-06664.3Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote att CVE-2014-06676.3The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote auth CVE-2014-06684.3Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitra CVE-2014-06695.0The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote CVE-2014-06704.3Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary we CVE-2014-06715.8Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attack CVE-2014-06724.0The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated us CVE-2014-06734.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote at CVE-2014-06746.8Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attac CVE-2014-06756.4The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different cus