Unscored severity · published Jan 21, 2015
CVE-2015-0513
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Vipr Srm · Emc
through 3.6.0 · source: NVD
WA
Watch4net · Emc
through 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0513
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0513
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2015-01/0092.html
Third Party Advisory
http://www.securityfocus.com/bid/72259
www.securitytracker.com
http://www.securitytracker.com/id/1031567
More from Vipr Srm
9.8
CVE-2016-0922
EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing…
8.8
CVE-2016-0891
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators
7.6
CVE-2016-6641
Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2016-6643
Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2016-6642
Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files