2.6

CVE-2010-1515

Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword parameter in conjunction with a /admin/multimedia/set/list PATH_INFO; the (4) keyword or (5) fileId parameter in conjunction with a /admin/multimedia/file/list PATH_INFO; or the (6) name, (7) email, or (8) address parameter in conjunction with a /admin/ad/client/list PATH_INFO.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tomatocms ≫ Tomatocms Version <= 2.0.6
Tomatocms ≫ Tomatocms Version 2.0.0
Tomatocms ≫ Tomatocms Version 2.0.1
Tomatocms ≫ Tomatocms Version 2.0.2
Tomatocms ≫ Tomatocms Version 2.0.3
Tomatocms ≫ Tomatocms Version 2.0.3.1430
Tomatocms ≫ Tomatocms Version 2.0.3.1622
Tomatocms ≫ Tomatocms Version 2.0.4
Tomatocms ≫ Tomatocms Version 2.0.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.03% 0.591
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://holisticinfosec.org/content/view/148/45/
http://secunia.com/advisories/39680
Vendor Advisory
http://www.securityfocus.com/bid/40544
http://secunia.com/secunia_research/2010-58/
Vendor Advisory