Unscored severity · published Feb 17, 2009
CVE-2009-0611
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Open Enterprise Server · Novell
1.x · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0611
osvdb.org
http://osvdb.org/51941
Exploit
http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt
Vendor Advisory
http://secunia.com/advisories/33886
Exploit
http://www.securityfocus.com/bid/33708
www.securitytracker.com
http://www.securitytracker.com/id?1021695
www.vupen.com
http://www.vupen.com/english/advisories/2009/0421
More from Open Enterprise Server
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
7.8
CVE-2013-2016
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device
7.8
CVE-2009-0115
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly…
7.5
CVE-2017-5182
Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory…