CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8687 – Alcatel Lucent Home Device Manager Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-8687
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do. Múltiples vulnerabilidades de XSS en Management Console en Alcatel-Lucent Motive Home Device Manager (HDM) en versiones anteriores a 4.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) deviceTypeID para DeviceType/getDeviceType.do; el parámetro (2) policyActionClass o (3) policyActionName para PolicyAction/findPolicyActions.do; el parámetro deviceID para (4) SingleDeviceMgmt/getDevice.do o (5) device/editDevice.do; el parámetro de operación para (6) ajax.do o (7) xmlHttp.do; o el parámetro (8) policyAction, (9) policyClass, o (10) policyName para policy/findPolicies.do. The Alcatel Lucent Home Device Manager management console suffers from multiple cross site scripting vulnerabilities. • http://seclists.org/fulldisclosure/2016/Jan/0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-6498
https://notcve.org/view.php?id=CVE-2015-6498
Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices. Alcatel-Lucent Home Device Manager en versiones anteriores a la 4.1.10, y en versiones 4.2.x anteriores a la 4.2.2 permite que atacantes remotos hagan una suplantación y realicen llamadas como dispositivos objetivo. • http://packetstormsecurity.com/files/134191/Alcatel-Lucent-Home-Device-Manager-Spoofing.html http://seclists.org/fulldisclosure/2015/Nov/6 http://www.securityfocus.com/bid/77406 • CWE-254: 7PK - Security Features •