Unscored severity · published Jul 8, 2010
CVE-2010-2654
Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allow remote attackers to inject arbitrary web script or HTML via the (1) INDEX or (2) IPADDR parameter to private/cindefn.php, (3) the domain parameter to private/power_management_policy_options.php, the slot parameter to (4) private/pm_temp.php or (5) private/power_module.php, (6) the WEBINDEX parameter to private/blade_leds.php, or (7) the SLOT parameter to private/ipmi_bladestatus.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Advanced Management Module · Ibm
through 2.48; through 3.54; 1.00; 1.01; 1.20; 1.20; +33 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2654
Exploit
http://dsecrg.com/pages/vul/show.php?id=154
osvdb.org
http://osvdb.org/66122
osvdb.org
http://osvdb.org/66125
osvdb.org
http://osvdb.org/66126
osvdb.org
http://osvdb.org/66127
osvdb.org
http://osvdb.org/66128
More from Advanced Management Module
–
CVE-2014-0860
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in…
–
CVE-2013-4007
Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter…
–
CVE-2010-2656
The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web…
–
CVE-2010-2655
Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other…
–
CVE-2010-1460
The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to…