CVE ID:	CVE-2007-3386
Description:	Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Test IDs:	1.3.6.1.4.1.25623.1.0.59876   1.3.6.1.4.1.25623.1.0.59877   1.3.6.1.4.1.25623.1.0.60102   1.3.6.1.4.1.25623.1.0.122660
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-3386 BugTraq ID: 25314 http://www.securityfocus.com/bid/25314 Bugtraq: 20070814 CVE-2007-3386: XSS in Host Manager (Google Search) http://www.securityfocus.com/archive/1/476448/100/0/threaded Bugtraq: 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/500396/100/0/threaded Bugtraq: 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) (Google Search) http://www.securityfocus.com/archive/1/500412/100/0/threaded Debian Security Information: DSA-1447 (Google Search) http://www.debian.org/security/2008/dsa-1447 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html HPdes Security Advisory: HPSBTU02276 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554 HPdes Security Advisory: HPSBUX02262 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 HPdes Security Advisory: SSRT071447 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 HPdes Security Advisory: SSRT071472 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554 http://jvn.jp/jp/JVN%2359851336/index.html http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 http://osvdb.org/36417 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077 RedHat Security Advisories: RHSA-2007:0871 http://www.redhat.com/support/errata/RHSA-2007-0871.html http://securitytracker.com/id?1018558 http://secunia.com/advisories/26465 http://secunia.com/advisories/26898 http://secunia.com/advisories/27037 http://secunia.com/advisories/27267 http://secunia.com/advisories/27727 http://secunia.com/advisories/28317 http://secunia.com/advisories/33668 http://securityreason.com/securityalert/3010 SuSE Security Announcement: SUSE-SR:2009:004 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://www.vupen.com/english/advisories/2007/2880 http://www.vupen.com/english/advisories/2007/3386 http://www.vupen.com/english/advisories/2007/3527 http://www.vupen.com/english/advisories/2009/0233 XForce ISS Database: tomcat-hostmanager-alias-xss(36001) https://exchange.xforce.ibmcloud.com/vulnerabilities/36001