CVEvulnerability
CVE-2014-3080
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.
Affected configurations
• ibm global console manager 16 firmware (<= 1.20.0.22575)
• ibm global console manager 32 firmware (<= 1.20.0.22575)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jul/113 seclists.org
- http://www.exploit-db.com/exploits/34132/ Exploit
- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 Vendor Advisory
- http://www.securityfocus.com/bid/68777 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93929 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jul/113 seclists.org
- http://www.exploit-db.com/exploits/34132/ Exploit
- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 Vendor Advisory
- http://www.securityfocus.com/bid/68777 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93929 exchange.xforce.ibmcloud.com