{"title": "Novell iChain Login Credential XSS", "published": "2004-08-24T09:02:52", "references": [], "type": "osvdb", "enchantments": {"score": {"value": 4.8, "vector": "NONE", "modified": "2017-04-28T13:20:04", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2004-2580"]}], "modified": "2017-04-28T13:20:04", "rev": 2}, "vulnersScore": 4.8}, "cvelist": ["CVE-2004-2580"], "viewCount": 2, "affectedSoftware": [{"version": "2.3", "name": "iChain", "operator": "eq"}], "id": "OSVDB:9267", "modified": "2004-08-24T09:02:52", "href": "https://vulners.com/osvdb/OSVDB:9267", "edition": 1, "description": "## Vulnerability Description\nNovell iChain contains a undisclosed flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input passed to the webserver upon submission to an undisclosed script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server allowing the user to possibly steal login credentials, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, Novell has released a patch to address this vulnerability.\n## Short Description\nNovell iChain contains a undisclosed flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input passed to the webserver upon submission to an undisclosed script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server allowing the user to possibly steal login credentials, leading to a loss of integrity.\n## References:\nSecurity Tracker: 1011074\n[Secunia Advisory ID:12366](https://secuniaresearch.flexerasoftware.com/advisories/12366/)\n[Related OSVDB ID: 9268](https://vulners.com/osvdb/OSVDB:9268)\n[Related OSVDB ID: 9269](https://vulners.com/osvdb/OSVDB:9269)\n[Related OSVDB ID: 9266](https://vulners.com/osvdb/OSVDB:9266)\nOther Advisory URL: http://support.novell.com/cgi-bin/search/searchtid.cgi?/2969621.htm\nISS X-Force ID: 17133\n[CVE-2004-2580](https://vulners.com/cve/CVE-2004-2580)\nBugtraq ID: 11061\n", "bulletinFamily": "software", "reporter": "OSVDB", "cvss": {"vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/", "score": 5.8}, "lastseen": "2017-04-28T13:20:04", "immutableFields": []}

{"cve": [{"lastseen": "2021-02-02T05:23:01", "description": "Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.", "edition": 4, "cvss3": {}, "published": "2004-12-31T05:00:00", "title": "CVE-2004-2580", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2004-2580"], "modified": "2017-07-11T01:32:00", "cpe": ["cpe:/a:novell:ichain:2.3"], "id": "CVE-2004-2580", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2580", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:novell:ichain:2.3:*:*:*:*:*:*:*"]}]}