CVE-2008-2637

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.8%

from disclosure to weapon0 days

Published on NVDJun 10

1st PoCJun 5

exploitation probability

1.8%top 23% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/31885 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/31886

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/30550 http://securityreason.com/securityalert/3931 https://exchange.xforce.ibmcloud.com/vulnerabilities/42884 http://www.securityfocus.com/archive/1/493149/100/0/threaded http://www.securityfocus.com/bid/29574 http://www.securitytracker.com/id?1020205 http://www.vupen.com/english/advisories/2008/1765/references