Unscored severity · published Jun 18, 2008
CVE-2008-0925
Cross-site scripting (XSS) vulnerability in the iMonitor interface in Novell eDirectory 8.7.3.x before 8.7.3 sp10, and 8.8.x before 8.8.2 ftf2, allows remote attackers to inject…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the iMonitor interface in Novell eDirectory 8.7.3.x before 8.7.3 sp10, and 8.8.x before 8.8.2 ftf2, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters that are used within "error messages of the HTTP stack."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Edirectory · Novell
8.7.3.9; 8.7.3.9; 8.7.3.9; 8.7.3.9; 8.8; 8.8; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0925
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0925
Vendor Advisory
http://secunia.com/advisories/30748
securitytracker.com
http://securitytracker.com/id?1020321
support.novell.com
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
support.novell.com
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037181.html
www.novell.com
http://www.novell.com/support/viewContent.do?externalId=3460217&sliceId=1
www.securityfocus.com
http://www.securityfocus.com/bid/29782
More from Edirectory
9.8
CVE-2008-5038
Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to…
9.8
CVE-2002-2119
Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing
7.5
CVE-2017-9277
The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA
7.5
CVE-2017-9267
In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations
7.5
CVE-2017-5186
Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2…