Moole Vulnerability Database

Find real vulnerabilities before they ship

Unknown

CVE-2010-1104

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

PublishedMar 25, 2010, 17:30

Published Bycve@mitre.org

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

Zope2(PyPI)2.8.02.8.12N/A

Zope2(PyPI)2.9.02.9.12N/A

Zope2(PyPI)2.10.02.10.11N/A

Zope2(PyPI)2.11.02.11.6N/A

Zope2(PyPI)2.12.02.12.3N/A

References

http://secunia.com/advisories/38007
http://www.osvdb.org/61655
http://www.securityfocus.com/bid/37765
http://www.vupen.com/english/advisories/2010/0104
https://exchange.xforce.ibmcloud.com/vulnerabilities/55599
https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html

Weakness Type

CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base SeverityUnknown

Version

2.0

Attack Vector (AV)