Unscored severity · published Aug 29, 2008
CVE-2008-3860
Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors, (2) during local group creation, (3) during HTML redirects, (4) in the HTML import, (5) in the Rich…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors, (2) during local group creation, (3) during HTML redirects, (4) in the HTML import, (5) in the Rich text editor, and (6) in link-page in IBM Lotus Quickr 8.1 services for Lotus Domino before Hotfix 15 allow remote attackers to inject arbitrary web script or HTML via unknown vectors, including (7) the Imported Page. NOTE: the vulnerability in the WYSIWYG editors may exist because of an incomplete fix for CVE-2008-2163.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LQ
Lotus Quickr · Ibm
8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3860
osvdb.org
http://osvdb.org/49772
osvdb.org
http://osvdb.org/49776
Vendor Advisory
http://secunia.com/advisories/31634
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg27013341
www.securitytracker.com
http://www.securitytracker.com/id?1020762
www.vupen.com
http://www.vupen.com/english/advisories/2008/2444
More from Lotus Quickr
–
CVE-2012-2176
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary…
–
CVE-2008-7284
IBM Lotus Quickr 8.1 before 8100.003 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by clicking a download link, aka SPR…
–
CVE-2008-7285
Unspecified vulnerability in the docnote string handling implementation in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allows remote attackers to cause a denial…
–
CVE-2008-7286
IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images, which allows remote authenticated users to cause a denial of…
–
CVE-2009-5058
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.5 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by…