CVE-2009-0611

EPSS 2.2%

Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.org/0902-exploits/nqfs-xss.txtunverified exploitdbwww.exploit-db.com/exploits/32795unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/51941 http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt http://secunia.com/advisories/33886 https://exchange.xforce.ibmcloud.com/vulnerabilities/48619 http://www.securityfocus.com/bid/33708 http://www.securitytracker.com/id?1021695 http://www.vupen.com/english/advisories/2009/0421