CVE-2012-3341

MediumCVSS 5.4/10Last modified Jun 16, 2026

Description

IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 78294.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	InfoSphere Guardium	7.00; 8.0; 8.01; 8.2

References

http://www-01.ibm.com/support/docview.wss?uid=swg21611131Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/78294VDB Entry, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21611131Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/78294VDB Entry, Vendor Advisory

Timeline

Published: Sep 1, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-334210.0Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allo CVE-2012-33436.8Cross-site request forgery (CSRF) vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other prod CVE-2012-33455.6ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.CVE-2012-33476.0AutoFORM PDM Archive before 7.0 implements user accounts in a way that allows for JMX Console authentication, which allows remote authentica CVE-2012-33506.8SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP he CVE-2012-33516.1Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary CVE-2012-33537.5The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files i CVE-2012-33544.3doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive i CVE-2012-33553.6(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows CVE-2012-33565.0The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows r CVE-2012-33575.0The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is cop CVE-2012-335810.0Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of servi