4.3
CVE-2010-0920
- EPSS 1.03%
- Veröffentlicht 03.03.2010 19:30:00
- Zuletzt bearbeitet 16.06.2026 23:17:08
- Erkennungen
LoginCross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Lotus Inotes Version <= 229.271
Ibm ≫ Lotus Inotes Version 229.011
Ibm ≫ Lotus Inotes Version 229.021
Ibm ≫ Lotus Inotes Version 229.031
Ibm ≫ Lotus Inotes Version 229.041
Ibm ≫ Lotus Inotes Version 229.051
Ibm ≫ Lotus Inotes Version 229.061
Ibm ≫ Lotus Inotes Version 229.101
Ibm ≫ Lotus Inotes Version 229.111
Ibm ≫ Lotus Inotes Version 229.131
Ibm ≫ Lotus Inotes Version 229.141
Ibm ≫ Lotus Inotes Version 229.151
Ibm ≫ Lotus Inotes Version 229.161
Ibm ≫ Lotus Inotes Version 229.171
Ibm ≫ Lotus Inotes Version 229.181
Ibm ≫ Lotus Inotes Version 229.191
Ibm ≫ Lotus Inotes Version 229.201
Ibm ≫ Lotus Inotes Version 229.211
Ibm ≫ Lotus Inotes Version 229.221
Ibm ≫ Lotus Inotes Version 229.231
Ibm ≫ Lotus Inotes Version 229.241
Ibm ≫ Lotus Inotes Version 229.251
Ibm ≫ Lotus Inotes Version 229.261
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.03% | 0.593 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://www-01.ibm.com/support/docview.wss?uid=swg27018109
http://www.securityfocus.com/bid/38459
http://www.vupen.com/english/advisories/2010/0496