

Cisco ASA WebVPN Cross Site Scripting Vulnerability - ciscozine
http://www.ciscozine.com/2009/04/26/cisco-asa-webvpn-cross-site-scripting-vulnerability/

======
almost
Seems to rely on forcing the user to make a request with an arbitrary "host"
header. Can you do that from javascript or some other webpage embeddable
thingy? If you can't then it's not such a big problem (although obviously it
still shouldn't be like that)

