CVE-2007-6407

IBM Tivoli Provisioning Manager Express - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Provisioning Manager Express allow remote attackers to inject arbitrary web script or HTML via the (1) "assess modification," (2) user-id, and other unspecified fields to the /tpmx URI; or (3) involving unspecified vectors related to "error processing."

References (4)

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1019045

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/38864

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/484607/100/0/threaded

[Third Party Advisory] http://securityreason.com/securityalert/3458

Scores

EPSS 0.0026

EPSS Percentile 48.7%

Classification

CWE

CWE-79

Status draft

Affected Products (1)

ibm/tivoli_provisioning_manager_express

Timeline

Published Dec 17, 2007

Tracked Since Feb 18, 2026