CVE-2016-9834
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 1.8%
from disclosure to weapon0 days
Published on NVDJun 7
1st PoCMay 25
exploitation probability
1.8%top 23% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmware through 10.6.4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a request to the "LiveConnectionDetail.jsp" application. GET parameters "applicationname" and "username" are improperly sanitized allowing an attacker to inject arbitrary JavaScript into the page. This can be abused by an attacker to perform a cross-site scripting attack on the user. A vulnerable URI is /corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/42062unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://seclists.org/bugtraq/2017/Jun/4