CVE-2015-3447

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2015/Apr/97Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535393/100/0/threaded
http://www.securityfocus.com/bid/74406Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032204Third Party Advisory, VDB Entry
http://www.vulnerability-lab.com/get_content.php?id=1359Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Apr/97Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535393/100/0/threaded
http://www.securityfocus.com/bid/74406Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032204Third Party Advisory, VDB Entry
http://www.vulnerability-lab.com/get_content.php?id=1359Exploit, Third Party Advisory

Timeline

Published: Apr 29, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-34482.1REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information b CVE-2015-34497.2The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows CVE-2015-34508.8Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a CVE-2015-34515.0The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct CVE-2015-34547.5TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashe CVE-2015-34552.6Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do CVE-2015-34567.7The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (o CVE-2015-34575.0Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarde CVE-2015-34586.5The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14 CVE-2015-345910.0The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, wh CVE-2015-36105.4The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which CVE-2015-36118.8A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, whic