CVE-2009-4848 | BDVDB-2026-41603 Detail

Description#

Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to tvserver/server/user/addDepartment.jsp, (3) ID parameter to tvserver/server/inventory/inventoryTabs.jsp, (4) reportName parameter to tvserver/reports/virtualIQAdminReports.do, or (5) middleName parameter in a save action to tvserver/user/user.do.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://secunia.com/advisories/37359
http://www.securityfocus.com/archive/1/507729/100/0/threaded
http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt

Exploit#

No public exploit known

History#

Version 12010-05-07Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.