Unscored severity · published Mar 13, 2009
CVE-2008-6465
Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
H-sphere · Parallels
3.0.0; 3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6465
osvdb.org
http://osvdb.org/48232
Vendor Advisory
http://secunia.com/advisories/31830
Exploit
http://www.securityfocus.com/bid/31256
Exploit
http://www.xssing.com/index.php?x=3&y=65
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
More from H-sphere
6.1
CVE-2022-30777
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter
–
CVE-2012-5004
Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that (1)…