CVE-2014-6161
Low
Low
Medium
High
Critical
CVSS Score
Vulnerability Description
Cross-site scripting (XSS) vulnerability in IBM Tivoli Netcool/Impact 6.1.1 before 6.1.1.1-TIV-NCI-IF0001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Known Affected Software
1 configuration(s) from 1 vendor(s)
tivoli_netcool\/impact
Version:
6.1.1
CPE:
cpe:2.3:a:ibm:tivoli_netcool\/impact:6.1.1:*:*:*:*:*:*:*
This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://secunia.com/advisories/62168psirt@us.ibm.com
-
http://www-01.ibm.com/support/docview.wss?uid=swg21689130psirt@us.ibm.com Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/97710psirt@us.ibm.com
-
http://secunia.com/advisories/62168af854a3a-2127-422b-91ae-364da2661108
-
http://www-01.ibm.com/support/docview.wss?uid=swg21689130af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/97710af854a3a-2127-422b-91ae-364da2661108
Severity Details
out of 10.0
Low
Weakness Type (CWE)
CWE-79
Top 25 #1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Description
- The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- Exploit Likelihood
- High
- Typical Severity
- Medium
- OWASP Top 10
- A03:2021-Injection
- Abstraction Level
- Base
Key Information
- Published Date
- November 08, 2014
