CVE-2015-1981

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4, when Webmail is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH9WYPR5.

Metrics

CVSS 2.0 2.1/10AV:N/AC:H/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2015/Jun/56Mailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21959908Patch, Vendor Advisory
http://www.securityfocus.com/bid/74908Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032673Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jun/56Mailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21959908Patch, Vendor Advisory
http://www.securityfocus.com/bid/74908Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032673Third Party Advisory, VDB Entry

Timeline

Published: Jun 28, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-19824.0IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to CVE-2015-19833.5Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to CVE-2015-19844.0IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to CVE-2015-19855.6The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private k CVE-2015-198610.0The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified ve CVE-2015-19877.8IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentic CVE-2015-19883.5Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.CVE-2015-19896.5SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execut CVE-2015-19927.2IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, w CVE-2015-19935.0IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, CVE-2015-19945.0IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session CVE-2015-19954.3Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attack