CVE-2014-3080

Description

Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/93929

http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983

http://seclists.org/fulldisclosure/2014/Jul/113

http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3