{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:40:28Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20100201-CVE-2010-0440","slug":"cisco-sa-20100201-cve-2010-0440","vendor":"Cisco","title":"Cisco Secure Desktop Remote Cross-Site Scripting Vulnerability","summary":"Cisco Secure Desktop contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to a lack of input sanitation in the Cisco Secure Desktop.  An unauthenticated, remote attacker could exploit this vulnerability by convincing a targeted user to visit a malicious website that is designed to submit an HTTP POST request to the web interface of the affected product.  If the targeted user visits the malicious page, the attacker could execute arbitrary script code in the browser of the user in the security context of the affected site. Proof-of-concept code is publicly available. Cisco has confirmed this vulnerability and released updated software. To exploit this vulnerability, an attacker must convince a targeted user to visit a malicious website.  Performing an exploit will likely require the attacker to use social engineering tactics, such as sending targeted users a link to the site via e-mail, instant messaging, or another form of communication. Cisco would like to thank Matias Pablo Brutti and Ernesto Alvarez from Core Security Technologies for discovering this vulnerability. Because of changes made in Cisco Secure Desktop 3.5, Cisco ASA with an older version of ASA firmware but with Cisco Secure Desktop 3.5 or later will not be affected by this vulnerability. The problem is fixed for Cisco ASA firmware version8.0(5) and later.","severity":"Medium","published_at":"2010-02-01T19:54:02Z","updated_at":"2010-02-01T19:54:02Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20100201-CVE-2010-0440","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20100201-CVE-2010-0440/csaf/Cisco-SA-20100201-CVE-2010-0440.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":2,"public_evidence_count":2,"kev_count":0},"cves":[{"id":"CVE-2010-0440","kev":false}],"public_evidence":[{"product":{"name":"Cisco Secure Desktop","slug":"cisco-secure-desktop","vendor":"Cisco"},"cve":{"id":"CVE-2010-0440"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:30:12Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Secure Desktop","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2010-02-01T19:54:02Z","updated_at":"2010-02-01T19:54:02Z","advisory_updated_at":"2010-02-01T19:54:02Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20100201-CVE-2010-0440","row_display_order":1},{"product":{"name":"Cisco PIX/ASA","slug":"cisco-pix-asa","vendor":"Cisco"},"cve":{"id":"CVE-2010-0440"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:30:12Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco PIX/ASA","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2010-02-01T19:54:02Z","updated_at":"2010-02-01T19:54:02Z","advisory_updated_at":"2010-02-01T19:54:02Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20100201-CVE-2010-0440","row_display_order":2}]}