CVE-2010-4120
IBM Tivoli Access Manager for e-business 6.1.0 - Cross-Site Scripting via TAM Console Parameters
Title source: llmExploitation Summary
EIP tracks 11 public exploits for CVE-2010-4120. PoCs published by IBM.
AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business by injecting a script tag via the 'parm1' parameter. The payload triggers an alert box, confirming the vulnerability.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method parameter to (2) acl, (3) domain, (4) group, (5) gso, (6) gsogroup, (7) os, (8) pop, (9) rule, (10) user, or (11) webseal in ibm/wpm/.
Exploits (11)
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business by injecting a script tag via the 'parm1' parameter. The payload triggers an alert box, confirming the vulnerability.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager by injecting a malicious script via the 'method' parameter in the URL. The payload triggers an alert box, confirming the vulnerability.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager by injecting a script tag into the 'method' parameter of the user endpoint. The payload executes arbitrary JavaScript in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager by injecting a malicious script via the 'method' parameter in the URL. The PoC triggers an alert box, proving arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a malicious script via the 'method' parameter in the URL. The PoC shows how arbitrary JavaScript can be executed in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager by injecting a script tag into the 'method' parameter of the '/ibm/wpm/os' endpoint. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a script tag into the 'method' parameter of the 'gsogroup' endpoint. The payload executes arbitrary JavaScript in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a malicious script into the 'method' parameter of the '/ibm/wpm/gso' endpoint. The PoC URL triggers an alert box, confirming the vulnerability.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a script tag into the 'method' parameter of the '/ibm/wpm/group' endpoint. The payload executes arbitrary JavaScript in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a malicious script via the 'method' parameter in the URL. The PoC uses a simple JavaScript alert to confirm the vulnerability.
The exploit demonstrates a reflected XSS vulnerability in IBM Tivoli Access Manager for e-business 6.1.0 by injecting a script tag into the 'method' parameter of the '/ibm/wpm/acl' endpoint. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.