CVE-2016-9202

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the affected interface on an affected device. More Information: CSCvb37346. Known Affected Releases: 9.1.1-036 9.7.1-066.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/aCisco Email Security Appliance (ESA)Cisco Email Security Appliance (ESA)

References

Timeline

Published
Dec 14, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-92037.5A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco ASR 5000 Series Software could allow an unauthenticated, remCVE-2016-92046.5A vulnerability in the Cisco Intercloud Fabric (ICF) Director could allow an unauthenticated, remote attacker to connect to internal serviceCVE-2016-92057.5A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the CVE-2016-92066.1A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to conduCVE-2016-92076.5A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP conCVE-2016-92086.5A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder coulCVE-2016-92094.3A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that CVE-2016-92107.5A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthenticaCVE-2016-92117.5A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote CVE-2016-92127.5A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security AppliancesCVE-2016-92146.1Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site sCVE-2016-92157.8A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the roo
CVE-2016-9202: Medium severity, CVSS 6.1 | Vulnix