Unscored severity · published May 22, 2008
CVE-2008-2410
Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LD
Lotus Domino Web Server · Ibm
through 8.0; 7.0; 7.0.1; 7.0.2; 7.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2410
Vendor Advisory
http://secunia.com/advisories/30310
Vendor Advisory
http://secunia.com/advisories/30332
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=swg21303296
www.securityfocus.com
http://www.securityfocus.com/bid/29311
www.vupen.com
http://www.vupen.com/english/advisories/2008/1597
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/42553
More from Lotus Domino Web Server
–
CVE-2007-0067
Unspecified vulnerability in the Lotus Domino Web Server 6.0, 6.5.x before 6.5.6, and 7.0.x before 7.0.3 allows remote attackers to cause a denial of service (daemon crash) via…
–
CVE-2003-0178
Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary code via (1) the s_ViewName option in…
–
CVE-2003-0179
Buffer overflow in the COM Object Control Handler for Lotus Domino 6.0.1 and earlier allows remote attackers to execute arbitrary code via multiple attack vectors, as demonstrated…
–
CVE-2003-0180
Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via an incomplete POST request, as demonstrated using the h_PageUI form
–
CVE-2003-0181
Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via a "Fictionary Value Field POST request" as demonstrated using the…