{"api_version":"1","generated_at":"2026-07-23T05:43:26+00:00","cve":"CVE-2014-3080","urls":{"html":"https://cve.report/CVE-2014-3080","api":"https://cve.report/api/cve/CVE-2014-3080.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3080","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3080"},"summary":{"title":"CVE-2014-3080","description":"Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.","state":"PUBLISHED","assigner":"ibm","published_at":"2014-08-17 23:55:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983","name":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93929","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93929","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/68777","name":"http://www.securityfocus.com/bid/68777","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"IBM 1754 GCM16 and GCM32 Global Console Managers Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2014/Jul/113","name":"http://seclists.org/fulldisclosure/2014/Jul/113","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: IBM GCM16/32 v1.20.0.22575 vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html","name":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM 1754 GCM KVM Code Execution / File Read / XSS ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/34132/","name":"http://www.exploit-db.com/exploits/34132/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3080","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3080","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3080","vulnerable":"1","versionEndIncluding":"1.20.0.22575","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"global_console_manager_16_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3080","vulnerable":"1","versionEndIncluding":"1.20.0.22575","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"global_console_manager_32_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:35:55.974Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html"},{"name":"68777","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/68777"},{"name":"34132","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/34132/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983"},{"name":"20140721 IBM GCM16/32 v1.20.0.22575 vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Jul/113"},{"name":"ibm-gcm-cve20143080-xss(93929)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93929"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-07-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html"},{"name":"68777","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/68777"},{"name":"34132","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/34132/"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983"},{"name":"20140721 IBM GCM16/32 v1.20.0.22575 vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Jul/113"},{"name":"ibm-gcm-cve20143080-xss(93929)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93929"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-3080","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html"},{"name":"68777","refsource":"BID","url":"http://www.securityfocus.com/bid/68777"},{"name":"34132","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/34132/"},{"name":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983","refsource":"CONFIRM","url":"http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983"},{"name":"20140721 IBM GCM16/32 v1.20.0.22575 vulnerabilities","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Jul/113"},{"name":"ibm-gcm-cve20143080-xss(93929)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93929"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-3080","datePublished":"2014-08-17T23:00:00.000Z","dateReserved":"2014-04-29T00:00:00.000Z","dateUpdated":"2024-08-06T10:35:55.974Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-17 23:55:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:global_console_manager_16_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.20.0.22575","matchCriteriaId":"5A20A7D6-73FB-4E05-9D73-C23E20513AE5"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:global_console_manager_32_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.20.0.22575","matchCriteriaId":"40D05CCE-C686-4D08-B4FE-B5C02DFA5EE3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3080","Ordinal":"1","Title":"CVE-2014-3080","CVE":"CVE-2014-3080","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3080","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.","Type":"Description","Title":"CVE-2014-3080"},{"CveYear":"2014","CveId":"3080","Ordinal":"2","NoteData":"2014-08-17","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3080","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}