Unscored severity · published Sep 14, 2007
CVE-2007-4900
Cross-site scripting (XSS) vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Envision · Rsa
3.3.6_build_0115 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4900
osvdb.org
http://osvdb.org/37099
secunia.com
http://secunia.com/advisories/26707
securityreason.com
http://securityreason.com/securityalert/3137
www.securityfocus.com
http://www.securityfocus.com/archive/1/479183/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/25645
www.vupen.com
http://www.vupen.com/english/advisories/2007/3198
More from Envision
–
CVE-2012-0403
Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vectors
–
CVE-2012-0402
EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors
–
CVE-2012-0401
Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors
–
CVE-2012-0400
EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to obtain access via a…
–
CVE-2012-0399
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified…