CVE-2004-1640

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.

Published Bycve@mitre.org

Published DateAug 28, 2004, 04:00

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://cyruxnet.org/modulo_dic_xoops.htm
http://marc.info/?l=bugtraq&m=109394077209963&w=2
http://secunia.com/advisories/12424
http://www.osvdb.org/9393
http://www.osvdb.org/9394
http://www.securityfocus.com/bid/11064
https://exchange.xforce.ibmcloud.com/vulnerabilities/17152
https://exchange.xforce.ibmcloud.com/vulnerabilities/17154

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE