CVE-2013-4653

https://notcve.org/view.php?id=CVE-2013-4653

Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors. Múltiples vulnerabilidades XSS en la funcionalidad de firmado de ics en los servicios MyTeamwork en Alcatel-Lucent Omnitouch 8660 My Teamwork anterior a 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) anterior a 6.7, Omnitouch 8460 Advanced Communication Server anterior a 9.1, y OmniTouch 8400 Instant Communications Suite anterior a 6.7.3 (1) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de una URL que resulta en un XSS reflejado o (2) permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a través de una entrada en los favoritos que resulta en un XSS almacenado. No se han especificado los vectores. • http://osvdb.org/94810 http://osvdb.org/94811 http://secunia.com/advisories/54000 http://www.securityfocus.com/bid/60902 http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm https://exchange.xforce.ibmcloud.com/vulnerabilities/85382 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •