Some vulnerabilities have been reported in IBM Lotus Quickr, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input via unspecified parameters e.g. when creating a local group, adding a page using "Imported Page", in the WYSIWYG editors, in the html import functionality, and in the Rich text editor is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in Lotus Quickr 8.1 and 8.0.0.2. Other versions may also be affected.

NOTE: Potential cross-site scripting vulnerabilities in the page_content filter match handling and related to qpconfig have also been reported in Lotus Quickr 8.0.0.2.

Solution
Lotus Quickr 8.1:
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27013341
http://www-01.ibm.com/support/docview.wss?uid=swg24016411

Deep Links
Links available to Secunia VIM customers