Description
Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Foundations Start before 1.2.2c allow remote authenticated users to inject arbitrary web script or HTML via a Webconfig Users user-attribute field, as demonstrated by the (1) First Name or (2) Last Name field.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21620319
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79537
Scores
EPSS
0.0076
EPSS Percentile
51.5%
Details
CWE
CWE-79
Status
published
Products (4)
ibm/lotus_foundations_start
1.0
ibm/lotus_foundations_start
1.1
ibm/lotus_foundations_start
1.2
ibm/lotus_foundations_start
< 1.2.2
Published
Dec 19, 2012
Tracked Since
Feb 18, 2026