{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-07-02T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "94811", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/94811"}, {"name": "alcatel-cve20134653-myteamwork-xss(85382)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85382"}, {"name": "60902", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/60902"}, {"name": "54000", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/54000"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm"}, {"name": "94810", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/94810"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-4653", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "94811", "refsource": "OSVDB", "url": "http://osvdb.org/94811"}, {"name": "alcatel-cve20134653-myteamwork-xss(85382)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85382"}, {"name": "60902", "refsource": "BID", "url": "http://www.securityfocus.com/bid/60902"}, {"name": "54000", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/54000"}, {"name": "http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm", "refsource": "CONFIRM", "url": "http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm"}, {"name": "94810", "refsource": "OSVDB", "url": "http://osvdb.org/94810"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-4653", "datePublished": "2013-08-20T00:00:00", "dateReserved": "2013-06-24T00:00:00", "dateUpdated": "2017-08-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:alcatel-lucent:omnitouch_8400_instant_communications_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "151F02FA-8E80-49C7-8D51-4BAA80262449", "versionEndIncluding": "6.7.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:alcatel-lucent:omnitouch_8460_advanced_communication_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "99604110-6835-4971-AF7A-89A5F21DA6B7", "versionEndIncluding": "9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:alcatel-lucent:omnitouch_8660_my_teamwork:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D7664FC-4F80-464E-9378-ADEEEF199802", "versionEndIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:alcatel-lucent:omnitouch_8670_automated_delivery_message_delivery_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "70F7D656-415B-4297-A6FB-2752DDC07ABB", "versionEndIncluding": "6.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades XSS en la funcionalidad de firmado de ics en los servicios MyTeamwork en Alcatel-Lucent Omnitouch 8660 My Teamwork anterior a 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) anterior a 6.7, Omnitouch 8460 Advanced Communication Server anterior a 9.1, y OmniTouch 8400 Instant Communications Suite anterior a 6.7.3 (1) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s de una URL que resulta en un XSS reflejado o (2) permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a trav\u00e9s de una entrada en los favoritos que resulta en un XSS almacenado. No se han especificado los vectores."}], "id": "CVE-2013-4653", "lastModified": "2017-08-29T01:33:38.717", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-08-20T00:48:09.207", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/94810"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/94811"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/54000"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/60902"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85382"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}