Hugo Vazquez Carames

**Name of the Vulnerable Software and Affected Versions** Cisco IOS version 12.0(2a) **Description** A cross-site scripting (XSS) issue exists in the Cisco IOS Web Server, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved by either viewing packets containing HTML via an HTTP interface to the contents of memory buffers, demonstrated by the URI /level/15/exec/-/buffers/assigned/dump, or by sending the router Cisco Discovery Protocol (CDP) packets with an HTML payload that an administrator views via the CDP status pages. The vulnerability requires a user to browse a page containing dynamic content with injected HTML commands, which could be interpreted by the client browser and potentially execute malicious commands. **Recommendations** For Cisco IOS version 12.0(2a), update to a version that includes the fix for this issue, as Cisco will be making free software available to address this vulnerability. As a temporary workaround, consider restricting access to the HTTP interface and CDP status pages to minimize the risk of exploitation. Avoid using the /level/15/exec/-/buffers/assigned/dump URI until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Content Management Server (MCMS) 2001 **Description** A cross-site scripting issue exists, allowing remote attackers to execute arbitrary script code. This is achieved via the `REASONTXT` parameter in the ManualLogin.asp script. **Recommendations** For Microsoft Content Management Server (MCMS) 2001, avoid using the `REASONTXT` parameter in the ManualLogin.asp script until the issue is resolved. As a temporary workaround, consider restricting access to the ManualLogin.asp script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.