Unscored severity · published Dec 10, 2007
CVE-2007-6295
Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Lotus Sametime · Ibm
through 8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6295
osvdb.org
http://osvdb.org/39258
Vendor Advisory
http://secunia.com/advisories/27941
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249
www.securityfocus.com
http://www.securityfocus.com/bid/26734
www.securitytracker.com
http://www.securitytracker.com/id?1019053
www.vupen.com
http://www.vupen.com/english/advisories/2007/4104
More from Lotus Sametime
–
CVE-2013-3985
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by…
–
CVE-2013-3045
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function
–
CVE-2013-3044
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages,…
–
CVE-2013-0537
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance…
–
CVE-2013-3986
IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session