CVE-2008-1216

Published: Mar 9, 2008Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting (XSS) attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a JavaScript event in a malformed element, as demonstrated by an onload event in an IFRAME element.

Affected (1)

Products: Ibm: Lotus Quickr Server

1 product

Lotus Quickr Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Lotus Quickr Server	Version 8.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://secunia.com/advisories/29072

Source: cve@mitre.org

http://securityreason.com/securityalert/3721

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488620/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27925

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0667

Source: cve@mitre.org

http://secunia.com/advisories/29072

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/3721

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/488620/100/100/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/27925

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/0667

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.