Cross-site scripting (XSS) vulnerability in Blue Coat Systems (formerly CacheFlow) CacheOS on Client Accelerator 4.1.06, Security Gateway 2.1.02, and Server Accelerator 4.1.06 allows remote attackers to inject arbitrary web script or HTML via a URL to a nonexistent hostname that includes the HTML, which is inserted into the resulting error page.

The remote host is running NetworkActiv, a web server.  This version of NetworkActiv is vulnerable to a remote Cross-Site Scripting (XSS) attack.  An attacker exploiting this flaw would typically need to convince a user to browse to a malicious URI.  Success exploitation would result in the theft of confidential materials (such as authentication cookies).

The remote Cherokee web server is vulnerable to a flaw in the way that it parses user requests.  Specifically, an attacker can create queries such that unsanitized script code is displayed in user browsers.  An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious URI.  Successful exploitation would result in a possible loss of confidential materials.

The remote host is running a web server that fails to adequately sanitize request strings of malicious JavaScript. A remote attacker can exploit this issue, via a specially crafted request, to execute arbitrary HTML and script code in a user's browser within the security context of the affected site.

ID	Name	Product	Family	Severity
3156	NetworkActiv < 3.5.14 Multiple Parameter XSS	Nessus Network Monitor	Web Servers	low
3508	Cherokee Web Server < 0.5.1 XSS	Nessus Network Monitor	Web Servers	low
10815	Web Server Generic XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2002-1060

medium

Tenable Plugins

low

low

medium