{"api_version":"1","generated_at":"2026-07-23T15:25:56+00:00","cve":"CVE-2014-0680","urls":{"html":"https://cve.report/CVE-2014-0680","api":"https://cve.report/api/cve/CVE-2014-0680.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0680","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0680"},"summary":{"title":"CVE-2014-0680","description":"Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.","state":"PUBLISHED","assigner":"cisco","published_at":"2014-01-29 18:34:05","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/56672","name":"http://secunia.com/advisories/56672","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA56672 - Cisco Identity Services Engine (ISE) HTTP Control Interface for NAC Web Agent Cross-Site Scripting - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Security Notice: Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/65227","name":"http://www.securityfocus.com/bid/65227","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Identity Services Engine HTTP Control Interface for NAC Web Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Alert Details - Security Center - Cisco Systems","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/102588","name":"http://osvdb.org/102588","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1029701","name":"http://www.securitytracker.com/id/1029701","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Cisco Identity Services Engine Input Validation Flaw in NAC Web Agent Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0680","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0680","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"680","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"cisco","cpe5":"identity_services_engine","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2014","cve_id":"680","cve":"CVE-2014-0680","epss":"0.005320000","percentile":"0.673320000","score_date":"2026-05-04","updated_at":"2026-05-05 00:07:32"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:27:18.648Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617"},{"name":"20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680"},{"name":"65227","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/65227"},{"name":"102588","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/102588"},{"name":"56672","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/56672"},{"name":"1029701","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029701"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-01-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-01-02T19:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617"},{"name":"20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680"},{"name":"65227","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/65227"},{"name":"102588","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/102588"},{"name":"56672","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/56672"},{"name":"1029701","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029701"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-0680","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32617"},{"name":"20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680"},{"name":"65227","refsource":"BID","url":"http://www.securityfocus.com/bid/65227"},{"name":"102588","refsource":"OSVDB","url":"http://osvdb.org/102588"},{"name":"56672","refsource":"SECUNIA","url":"http://secunia.com/advisories/56672"},{"name":"1029701","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029701"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-0680","datePublished":"2014-01-29T16:00:00.000Z","dateReserved":"2014-01-02T00:00:00.000Z","dateUpdated":"2024-08-06T09:27:18.648Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-01-29 18:34:05","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:cisco:identity_services_engine:-:*:*:*:*:*:*:*","matchCriteriaId":"9A8A64C2-2A16-4A96-822D-2EFC3D61D58D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"680","Ordinal":"1","Title":"CVE-2014-0680","CVE":"CVE-2014-0680","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"680","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.","Type":"Description","Title":"CVE-2014-0680"},{"CveYear":"2014","CveId":"680","Ordinal":"2","NoteData":"2014-01-29","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"680","Ordinal":"3","NoteData":"2018-01-02","Type":"Other","Title":"Modified"}]}}}