XSS in Parallels H-Sphere
CVE-2008-6465
Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.
Affected products
- Parallels H-sphere — versions 3.0.0, 3.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
Frequently asked questions
- What is CVE-2008-6465?
- CVE-2008-6465 is a vulnerability in Parallels H-Sphere, classified under Cross-site Scripting. Published 2009-03-13.
- Is CVE-2008-6465 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.