CVE-2015-2872

Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature.

• CWE-79

• http://esupport.trendmicro.com/solution/en-US/1112206.aspxPatch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/248692Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/76397Third Party Advisory, VDB Entry
• http://esupport.trendmicro.com/solution/en-US/1112206.aspxPatch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/248692Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/76397Third Party Advisory, VDB Entry

Published

Aug 23, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2866SQL injection vulnerability on the Grandstream GXV3611_HD ca…
• CVE-2015-2867A design flaw in the Trane ComfortLink II SCC firmware versi…
• CVE-2015-2868An exploitable remote code execution vulnerability exists in…
• CVE-2015-2869The FileInfo plugin before 2.22 for Ghisler Total Commander …
• CVE-2015-2870Cross-site scripting (XSS) vulnerability on Chiyu BF-630, BF…
• CVE-2015-2871Chiyu BF-660C fingerprint access-control devices allow remot…
• CVE-2015-2873Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery…
• CVE-2015-2874Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, S…
• CVE-2015-2875Absolute path traversal vulnerability on Seagate GoFlex Sate…
• CVE-2015-2876Unrestricted file upload vulnerability on Seagate GoFlex Sat…
• CVE-2015-2877Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 thr…3.3
• CVE-2015-2878Multiple cross-site request forgery (CSRF) vulnerabilities i…