CVE-2015-2872

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://esupport.trendmicro.com/solution/en-US/1112206.aspxPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/248692Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/76397Third Party Advisory, VDB Entry
http://esupport.trendmicro.com/solution/en-US/1112206.aspxPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/248692Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/76397Third Party Advisory, VDB Entry

Timeline

Published: Aug 23, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-28735.5Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x b CVE-2015-28749.8Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before CVE-2015-28757.5Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, an CVE-2015-28768.8Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, a CVE-2015-28773.3Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest CVE-2015-28788.8Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication CVE-2015-28808.8TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.CVE-2015-28819.8Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.CVE-2015-28829.8Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a p CVE-2015-28835.4Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or sh CVE-2015-28847.5Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u CVE-2015-28859.8Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password o