4.3

CVE-2009-1428

Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to "two parsing errors."

Data is provided by the National Vulnerability Database (NVD)
Symantec ≫ Antivirus Version <= 10.1
Symantec ≫ Antivirus Version10.0
Symantec ≫ Antivirus Version10.0.1
Symantec ≫ Antivirus Version10.0.1.1
Symantec ≫ Antivirus Version10.0.2
Symantec ≫ Antivirus Version10.0.2.1
Symantec ≫ Antivirus Version10.0.2.2
Symantec ≫ Antivirus Version10.0.3
Symantec ≫ Antivirus Version10.0.4
Symantec ≫ Antivirus Version10.0.5
Symantec ≫ Antivirus Version10.0.6
Symantec ≫ Antivirus Version10.0.7
Symantec ≫ Antivirus Version10.0.8
Symantec ≫ Antivirus Version10.0.9
Symantec ≫ Endpoint Protection Version11.0
Symantec ≫ Norton 360 Version1.0
Symantec ≫ Norton Internet Security Version2005 Editionanti_spyware
Symantec ≫ Norton Internet Security Version2005 Editionprofessional
Symantec ≫ Norton Internet Security Version2005 Update11.0
Symantec ≫ Norton Internet Security Version2005 Update11.0.9
Symantec ≫ Norton Internet Security Version2005 Update11.5.6.14
Symantec ≫ Norton Internet Security Version2005_contains_nav_11.0.0
Symantec ≫ Norton Internet Security Version2006 Editionprofessional
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.24% 0.774
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.