CVEvulnerability
CVE-2010-3890
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-11-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface, as demonstrated by the command parameter to ESAdmin/collection.do.
Affected configurations
• ibm omnifind (<= 9.0)
• ibm omnifind 8.0
• ibm omnifind 8.4
• ibm omnifind 8.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt Exploit
- http://www.securityfocus.com/archive/1/514688/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/44740 Exploit
- http://www.vupen.com/english/advisories/2010/2933 Vendor Advisory
- http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt Exploit
- http://www.securityfocus.com/archive/1/514688/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/44740 Exploit
- http://www.vupen.com/english/advisories/2010/2933 Vendor Advisory