CVE-2019-1702

Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities either by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. In both cases, the attacker must persuade the user to click the crafted link or open the chat window that contains the attacker's code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Version 11.6(1) is affected.

• CWE-79
• CWE-79

• http://www.securityfocus.com/bid/107314Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-chatmail-xssVendor Advisory
• http://www.securityfocus.com/bid/107314Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-chatmail-xssVendor Advisory

Published

Mar 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17014If an image had not loaded correctly (such as when it is not…7.4
• CVE-2019-17015During the initialization of a new content process, a pointe…8.8
• CVE-2019-17016When pasting a <style> tag from the clipboard into a r…6.1
• CVE-2019-17017Due to a missing case handling object types, a type confusio…8.8
• CVE-2019-17018When in Private Browsing Mode on Windows 10, the Windows key…5.3
• CVE-2019-17019When Python was installed on Windows, a python file being se…8.8
• CVE-2019-17020If an XML file is served with a Content Security Policy and …6.5
• CVE-2019-17021During the initialization of a new content process, a race c…5.3
• CVE-2019-17022When pasting a <style> tag from the clipboard into a r…6.1
• CVE-2019-17023After a HelloRetryRequest has been sent, the client may nego…6.5
• CVE-2019-17024Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2019-17025Mozilla developers reported memory safety bugs present in Fi…8.8