2.6

CVE-2009-0455

Exploit
Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Glfusion ≫ Glfusion Version <= 1.1.1
Glfusion ≫ Glfusion Version1.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.62% 0.729
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/33878
Vendor Advisory
http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf
http://www.glfusion.org/article.php/xsscomments
Vendor Advisory
http://www.securityfocus.com/bid/33683
Patch
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/48603