Vulners
Lucene search
SpringSource Hyperic HQ Cross Site Scripting
🗓️ 23 Mar 2010 00:00:00Reported by SpringSource Security TeamType 
packetstorm🔗 packetstormsecurity.com👁 29 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Security Bulletin: TADDM affected by multiple vulnerabilities due to JRuby and Hyperic HQ | 10 Jan 202307:32 | – | ibm |
 | CVE-2009-2907 | 23 Mar 201000:00 | – | circl |
 | CVE-2009-2907 | 24 Mar 201018:00 | – | cve |
 | CVE-2009-2907 | 24 Mar 201018:00 | – | cvelist |
 | EUVD-2009-2895 | 7 Oct 202500:30 | – | euvd |
 | CVE-2009-2907 | 24 Mar 201022:45 | – | nvd |
 | Cross site scripting | 24 Mar 201022:45 | – | prion |
 | CVE-2009-2907 | 21 May 202520:17 | – | redhatcve |
 | CVE-2009-2907: SpringSource Hyperic HQ multiple XSS vulnerabilities | 24 Mar 201000:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 24 Mar 201000:00 | – | securityvulns |
10
`-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2009-2907: SpringSource Hyperic HQ multiple XSS vulnerabilities
Severity: Moderate
Vendor: SpringSource
Versions Affected:
SpringSource Hyperic HQ 4.2 pre-release versions
SpringSource Hyperic HQ 4.1.0 to 4.1.2
SpringSource Hyperic HQ 4.0.0 to 4.0.3
Earlier unsupported versions may also be affected
Summary:
Multiple fields are vulnerable to stored XSS.
Description:
Data retrieved from the database was used directly when forming the HTML output. This allowed an attacker to enter HTML in many of the input fields and have it used when the field was later displayed to a user. Data is now suitably encoded to make it safe for inclusion in HTML.
Mitigation:
Hyperic HQ Open Source users should upgrade to Hyperic HQ 4.2
Hyperic HQ Enterprise 4.1.x users may upgrade to Hyperic Enterprise 4.2 or 4.1.2.1
Hyperic HQ Enterprise 4.0.x users may upgrade to Hyperic Enterprise 4.2 or 4.0.3.2
Users of any earlier version should upgrade 4.2
Example:
Paste the following code into the description field:
<SCRIPT>alert("XSS Vulnerable")</SCRIPT>
Credit:
This vulnerability was discovered and reported to SpringSource by Aaron Kulick of CBS Interactive.
References:
http://www.springsource.com/security/hyperic-hq
The SpringSource Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32) - WinPT 1.2.0
iQIcBAEBAgAGBQJLqSfoAAoJECc+NjlVtVaxTmIP/1aEX8IK62sHc23F6P0ca4Cp
HkiUF+z2SJy06h8Ntq01ewoI9VoucWwo7VzdZo2iGtRezDKHD2uuxMCRgDCArNeZ
sjKRpZozeDPrWOBWe1YUP8shKltomi48oNS0N4mcVg3SQV4Lcu9dR9wppT0W/05C
1EqnJw75/36C187v1OhoiGDc1c+7V3aW2wndjhO6dgkBiigLd72kmx2zqux9kZWQ
0qpfqpTO3VxxUc0y47zNEDgI0e4q6iPL8NRvfcTdEI2cZNGWAEpWLeJW7fWAnsWd
T7b8ziRaQ1ZcHPUmp3CoCmGHGP/xOWhywYZXakuIJQpBUJ4ly46KicBWcHVExawR
KpQA8f5tZJyxHBn8PTxzz8+MYkwzhesyeHkKLcSfgO/0jfum+Ue1PMUIQQ682CQT
kEYkEKyUxIRxELaGiCTrpDdHp76MN/KzEl5DhgeOwhfd92M0U43twGNTL6xMOhbh
fdVEHL4tNeRcvX87mTk1vI0FtptGdsws1DDg2c1dP0fUFMTaySoK0oZG7cXr/NBt
xU/LYntxjuIQNj98eyPH9YjURGVII+0hcHY0WYVGI55dwxrtNj9Fb5UhiYuIIiQ/
woiLxIoIbW4bOfzlFEGPbn/TnpN8yzxJn36RbNU9i5hitTbLqBI9TERzM18hOFvj
+G0/W1h4a8IwgI2Fu59k
=NxoS
-----END PGP SIGNATURE-----
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Mar 2010 00:00Current
6.7Medium risk
Vulners AI Score6.7
EPSS0.00242