4.3

CVE-2009-1288

Exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to inject arbitrary web script or HTML via (1) the username in a login action or (2) the PATH parameter to private/file_management.ssi in the File manager.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Advanced Management Module Version 1.36h
Ibm ≫ Bladecenter Version e Edition 1881
Ibm ≫ Bladecenter Version e Edition 7967
Ibm ≫ Bladecenter Version e Edition 8677
Ibm ≫ Bladecenter Version h Edition 7989
Ibm ≫ Bladecenter Version h Edition 8852
Ibm ≫ Bladecenter Version hc10 Edition 7996
Ibm ≫ Bladecenter Version hs12 Edition 1916
Ibm ≫ Bladecenter Version hs12 Edition 8014
Ibm ≫ Bladecenter Version hs12 Edition 8028
Ibm ≫ Bladecenter Version hs20 Edition 1883
Ibm ≫ Bladecenter Version hs21 Edition 1885
Ibm ≫ Bladecenter Version hs21 Edition 8853
Ibm ≫ Bladecenter Version hs21_xm Edition 1915
Ibm ≫ Bladecenter Version hs21_xm Edition 7995
Ibm ≫ Bladecenter Version ht Edition 8740
Ibm ≫ Bladecenter Version ht Edition 8750
Ibm ≫ Bladecenter Version js12 Edition 7998
Ibm ≫ Bladecenter Version js21 Edition 7988
Ibm ≫ Bladecenter Version js21 Edition 8844
Ibm ≫ Bladecenter Version js22 Edition 7998
Ibm ≫ Bladecenter Version ls20 Edition 8850
Ibm ≫ Bladecenter Version ls21 Edition 7971
Ibm ≫ Bladecenter Version ls41 Edition 7972
Ibm ≫ Bladecenter Version qs21 Edition 0792
Ibm ≫ Bladecenter Version qs22 Edition 0793
Ibm ≫ Bladecenter Version s Edition 1948
Ibm ≫ Bladecenter Version s Edition 8886
Ibm ≫ Bladecenter Version t Edition 8720
Ibm ≫ Bladecenter Version t Edition 8730
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.77% 0.752
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://osvdb.org/53657
http://osvdb.org/53658
http://securitytracker.com/id?1022025
http://www.louhinetworks.fi/advisory/ibm_090409.txt
http://www.securityfocus.com/archive/1/502582/100/0/threaded
http://www.securityfocus.com/bid/34447
Exploit