CVE-2008-3821

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN28344798/index.htmlThird Party Advisory, VDB Entry
http://osvdb.org/51393Broken Link
http://osvdb.org/51394Broken Link
http://secunia.com/advisories/33461Third Party Advisory
http://securityreason.com/securityalert/4916Third Party Advisory
http://securitytracker.com/id?1021598Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_response09186a0080a5c501.htmlVendor Advisory
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-19Exploit
http://www.securityfocus.com/archive/1/500063/100/0/threaded
http://www.securityfocus.com/bid/33260Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/0138Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/47947Third Party Advisory, VDB Entry
http://jvn.jp/en/jp/JVN28344798/index.htmlThird Party Advisory, VDB Entry
http://osvdb.org/51393Broken Link
http://osvdb.org/51394Broken Link
http://secunia.com/advisories/33461Third Party Advisory
http://securityreason.com/securityalert/4916Third Party Advisory
http://securitytracker.com/id?1021598Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_response09186a0080a5c501.htmlVendor Advisory
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-19Exploit
http://www.securityfocus.com/archive/1/500063/100/0/threaded
http://www.securityfocus.com/bid/33260Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/0138Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/47947Third Party Advisory, VDB Entry

Timeline

Published: Jan 16, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-38234.3Cross-site scripting (XSS) vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers t CVE-2008-38244.3Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) extern CVE-2008-38254.4pam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing_ticket option is enabled, uses incorrect privileges when CVE-2008-38264.6Unspecified vulnerability in Condor before 7.0.5 allows attackers to execute jobs as other users via unknown vectors.CVE-2008-38279.3Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of se CVE-2008-38284.6Stack-based buffer overflow in the condor_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) and po CVE-2008-38295.0Unspecified vulnerability in the condor_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) via unkn CVE-2008-38307.2Condor before 7.0.5 does not properly handle when the configuration specifies overlapping netmasks in allow or deny rules, which causes the CVE-2008-38314.7The i915 driver in (1) drivers/char/drm/i915_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915_drv.c in Open CVE-2008-38324.9A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8, and before 2.6.26.5-45 on Fedora 9, allo CVE-2008-38334.9The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when CVE-2008-38342.1The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (appli