4.3

CVE-2009-3263

Exploit

Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version2.0.156.1
Google ≫ Chrome Version2.0.157.0
Google ≫ Chrome Version2.0.157.2
Google ≫ Chrome Version2.0.158.0
Google ≫ Chrome Version2.0.159.0
Google ≫ Chrome Version2.0.169.0
Google ≫ Chrome Version2.0.169.1
Google ≫ Chrome Version2.0.170.0
Google ≫ Chrome Version2.0.172
Google ≫ Chrome Version2.0.172.2
Google ≫ Chrome Version2.0.172.8
Google ≫ Chrome Version2.0.172.27
Google ≫ Chrome Version2.0.172.28
Google ≫ Chrome Version2.0.172.30
Google ≫ Chrome Version2.0.172.31
Google ≫ Chrome Version2.0.172.33
Google ≫ Chrome Version2.0.172.37
Google ≫ Chrome Version2.0.172.38
Google ≫ Chrome Version3.0.182.2
Google ≫ Chrome Version3.0.190.2
Google ≫ Chrome Version3.0.193.2 Updatebeta
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.571
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.