CVE-2013-7025

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 7.1 SP1 before Hotfix 134235 allow remote authenticated users to inject arbitrary web script or HTML via the (1) valfield_1 or (2) value_1 parameter to createNewThreshold.jsp.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-12/0022.htmlThird Party Advisory
http://osvdb.org/100610Broken Link
http://seclists.org/fulldisclosure/2013/Dec/32Exploit, Mailing List, Third Party Advisory
http://secunia.com/advisories/55923Third Party Advisory
http://www.exploit-db.com/exploits/30054Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64103Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029433Third Party Advisory, VDB Entry
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdfVendor Advisory
http://www.vulnerability-lab.com/get_content.php?id=1099Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/89462VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-12/0022.htmlThird Party Advisory
http://osvdb.org/100610Broken Link
http://seclists.org/fulldisclosure/2013/Dec/32Exploit, Mailing List, Third Party Advisory
http://secunia.com/advisories/55923Third Party Advisory
http://www.exploit-db.com/exploits/30054Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64103Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029433Third Party Advisory, VDB Entry
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdfVendor Advisory
http://www.vulnerability-lab.com/get_content.php?id=1099Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/89462VDB Entry

Timeline

Published: Dec 9, 2013
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-70264.7Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and s CVE-2013-70276.1The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame co CVE-2013-70307.3The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information fr CVE-2013-70324.3Multiple cross-site scripting (XSS) vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to i CVE-2013-70334.3LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might CVE-2013-70347.5The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP co CVE-2013-70386.4The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial CVE-2013-70395.1Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is CVE-2013-70404.3Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without r CVE-2013-70414.3The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the p CVE-2013-70424.6SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain p CVE-2013-70438.3Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 all