CVE-2015-6929 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to cftraces/filter/fl_copy.jsp; the (3) flName parameter to cftraces/filter/fl_crea1.jsp; the (4) serchStatus (5) refreshTime or (6) serchNode parameter to cftraces/process/pr_show_process.jsp; the (7) MaxActivationTime (8) NumberOfBytes (9) NumberOfTracefiles (10) SessionName or (11) serchSessionkind parameter to cftraces/session/se_crea.jsp; the (12) serchSessionDescription parameter to cftraces/session/se_show.jsp; the (13) serchApplication or (14) serchApplicationkind parameter to cftraces/session/tr_crea_filter.jsp; the (15) columKeyUnique (16) columParameter (17) componentName (18) criteria1 (19) criteria2 (20) criteria3 (21) description (22) filter (23) id (24) pathName (25) tableName or (26) component parameter to cftraces/session/tr_create_tagg_para.jsp; or the (27) userid parameter to home/certificate_association.jsp.

Reference

http://packetstormsecurity.com/files/133538/Nokia-Solutions-And-Networks-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Sep/42 https://drive.google.com/open?id=0B-LWHbwdK3P9eTNKRkdDWGpkN2M