CVE-2010-3890: XSS
First published: Fri Nov 12 2010(Updated: )
Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface, as demonstrated by the command parameter to ESAdmin/collection.do.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM OmniFind | =8.0 | |
| IBM OmniFind | =8.5 | |
| IBM OmniFind | =8.4 | |
| IBM OmniFind | <=9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-3890?
CVE-2010-3890 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2010-3890?
To remediate CVE-2010-3890, it is recommended to upgrade to IBM OmniFind Enterprise Edition version 9.1 or later.
What software is affected by CVE-2010-3890?
CVE-2010-3890 affects IBM OmniFind Enterprise Edition versions 8.0, 8.4, 8.5, and all versions up to 9.0.
What type of vulnerability is CVE-2010-3890?
CVE-2010-3890 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML.
Can CVE-2010-3890 be exploited remotely?
Yes, CVE-2010-3890 can be exploited remotely by attackers through the administration interface of IBM OmniFind.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/ibm
- canonical/ibm omnifind
- version/ibm omnifind/9.0
- version/ibm omnifind/8.0
- version/ibm omnifind/8.4
- version/ibm omnifind/8.5