Unscored severity · published Mar 9, 2007
CVE-2007-1367
Cross-site scripting (XSS) vulnerability in the login page in Avaya Communications Manager (CM) S87XX, S8500, and S8300 products before 3.1.3 allows remote attackers to inject…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the login page in Avaya Communications Manager (CM) S87XX, S8500, and S8300 products before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Login field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S8
S8300 · Avaya
cm_2.0; cm_3.1; r2.0.0; r2.0.1 · source: NVD
S8
S8500 · Avaya
cm_2.0; cm_3.1; r2.0.0; r2.0.1 · source: NVD
S8
S8700 · Avaya
cm_2.0; cm_3.1; r2.0.0; r2.0.1 · source: NVD
S8
S8710 · Avaya
cm_2.0; cm_3.1; r2.0.0; r2.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1367
secunia.com
http://secunia.com/advisories/24397
Patch
http://support.avaya.com/elmodocs2/security/ASA-2007-064.htm
www.osvdb.org
http://www.osvdb.org/33297
www.securityfocus.com
http://www.securityfocus.com/bid/22866
More from S8300
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2007-1491
Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside…
–
CVE-2004-1235
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute…
–
CVE-2005-0003
The 64 bit ELF support in Linux kernel 2.6 before 2.6.10, on 64-bit architectures, does not properly check for overlapping VMA (virtual memory address) allocations, which allows…
–
CVE-2004-0081
OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the…