{"api_version":"1","generated_at":"2026-07-23T12:22:37+00:00","cve":"CVE-2007-6295","urls":{"html":"https://cve.report/CVE-2007-6295","api":"https://cve.report/api/cve/CVE-2007-6295.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-6295","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-6295"},"summary":{"title":"CVE-2007-6295","description":"Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-12-10 18:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249","name":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://secunia.com/advisories/27941","name":"http://secunia.com/advisories/27941","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Lotus Sametime Meeting WebRunMenuFrame Page Cross-Site Scripting - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1019053","name":"http://www.securitytracker.com/id?1019053","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Lotus Sametime Input Validation Hole in WebRunMenuFrame Page Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/4104","name":"http://www.vupen.com/english/advisories/2007/4104","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38891","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38891","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/26734","name":"http://www.securityfocus.com/bid/26734","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://osvdb.org/39258","name":"http://osvdb.org/39258","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-6295","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-6295","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"6295","vulnerable":"1","versionEndIncluding":"8.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:02:36.076Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"sametime-webrunmenuframe-xss(38891)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38891"},{"name":"26734","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/26734"},{"name":"39258","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/39258"},{"name":"ADV-2007-4104","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/4104"},{"name":"27941","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/27941"},{"name":"1019053","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1019053"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-12-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"sametime-webrunmenuframe-xss(38891)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38891"},{"name":"26734","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/26734"},{"name":"39258","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/39258"},{"name":"ADV-2007-4104","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/4104"},{"name":"27941","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/27941"},{"name":"1019053","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1019053"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-6295","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"sametime-webrunmenuframe-xss(38891)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38891"},{"name":"26734","refsource":"BID","url":"http://www.securityfocus.com/bid/26734"},{"name":"39258","refsource":"OSVDB","url":"http://osvdb.org/39258"},{"name":"ADV-2007-4104","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/4104"},{"name":"27941","refsource":"SECUNIA","url":"http://secunia.com/advisories/27941"},{"name":"1019053","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1019053"},{"name":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249","refsource":"CONFIRM","url":"http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-6295","datePublished":"2007-12-10T18:00:00.000Z","dateReserved":"2007-12-10T00:00:00.000Z","dateUpdated":"2024-08-07T16:02:36.076Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-12-10 18:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:*:*:*:*:*:*:*:*","versionEndIncluding":"8.0","matchCriteriaId":"0E112082-D680-4926-B6A5-290C6E0041BB"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"6295","Ordinal":"1","Title":"CVE-2007-6295","CVE":"CVE-2007-6295","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"6295","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI.","Type":"Description","Title":"CVE-2007-6295"},{"CveYear":"2007","CveId":"6295","Ordinal":"2","NoteData":"2007-12-10","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"6295","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}