CVE Feed

    Dashboard / CVE / CVE-2010-2654

    CVE-2010-2654

    Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allow remote attackers to inject arbitrary web script or HTML via the (1) INDEX or (2) IPADDR parameter to private/cindefn.php, (3) the domain parameter to private/power_management_policy_options.php, the slot parameter to (4) private/pm_temp.php or (5) private/power_module.php, (6) the WEBINDEX parameter to private/blade_leds.php, or (7) the SLOT parameter to private/ipmi_bladestatus.php.

    Published:Jul 7, 2010
    Last Modified:Apr 11, 2025
    EPS:Jul 7, 2010
    EPSS Score:0.03436
    CVSS Score:4.3

    Affected Products

    Vendor
    Ibm
    Product
    Advanced Management Module
    Vendor
    Ibm
    Product
    Bladecenter

    Exploits

    http://dsecrg.com/pages/vul/show.php?id=154http://www.exploit-db.com/exploits/14237/http://www.securityfocus.com/bid/41383http://dsecrg.com/pages/vul/show.php?id=154http://www.exploit-db.com/exploits/14237/http://www.securityfocus.com/bid/41383https://www.exploit-db.com/exploits/14237

    Related CVEs

    CVE-2016-8232 (CVSS 6.1) — Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) v…
    CVE-2014-0860 (CVSS 5) — The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM…
    CVE-2013-4007 (CVSS 3.5) — Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware B…
    CVE-2010-2656 (CVSS 5) — The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versio…
    CVE-2010-2655 (CVSS 4) — Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Manageme…
    CVE-2010-1460 (CVSS 5) — The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform in…
    CVE-2009-1290 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced…
    CVE-2009-1289 (CVSS 4) — private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H …
    CVE-2009-1288 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High