4.3

CVE-2010-3201

Exploit
Cross-site scripting (XSS) vulnerability in NetWin Surgemail before 4.3g allows remote attackers to inject arbitrary web script or HTML via the username_ex parameter to the surgeweb program.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netwin ≫ Surgemail Version <= 4.2d4-4
Netwin ≫ Surgemail Version1.0c
Netwin ≫ Surgemail Version1.0d
Netwin ≫ Surgemail Version1.1a
Netwin ≫ Surgemail Version1.1b
Netwin ≫ Surgemail Version1.1c
Netwin ≫ Surgemail Version1.1d
Netwin ≫ Surgemail Version1.2a
Netwin ≫ Surgemail Version1.2b
Netwin ≫ Surgemail Version1.2c
Netwin ≫ Surgemail Version1.3a
Netwin ≫ Surgemail Version1.3a_rc1
Netwin ≫ Surgemail Version1.3b
Netwin ≫ Surgemail Version1.3c
Netwin ≫ Surgemail Version1.3d
Netwin ≫ Surgemail Version1.3e
Netwin ≫ Surgemail Version1.3f
Netwin ≫ Surgemail Version1.3g
Netwin ≫ Surgemail Version1.3h
Netwin ≫ Surgemail Version1.3i
Netwin ≫ Surgemail Version1.3j
Netwin ≫ Surgemail Version1.3k
Netwin ≫ Surgemail Version1.3l
Netwin ≫ Surgemail Version1.4a
Netwin ≫ Surgemail Version1.4b
Netwin ≫ Surgemail Version1.4c
Netwin ≫ Surgemail Version1.5a
Netwin ≫ Surgemail Version1.5b
Netwin ≫ Surgemail Version1.5c
Netwin ≫ Surgemail Version1.5d
Netwin ≫ Surgemail Version1.5d2
Netwin ≫ Surgemail Version1.5f
Netwin ≫ Surgemail Version1.6a
Netwin ≫ Surgemail Version1.6b
Netwin ≫ Surgemail Version1.6d
Netwin ≫ Surgemail Version1.6e
Netwin ≫ Surgemail Version1.6e2
Netwin ≫ Surgemail Version1.7a
Netwin ≫ Surgemail Version1.7b3
Netwin ≫ Surgemail Version1.8a
Netwin ≫ Surgemail Version1.8b3
Netwin ≫ Surgemail Version1.8d
Netwin ≫ Surgemail Version1.8e
Netwin ≫ Surgemail Version1.8f
Netwin ≫ Surgemail Version1.8g3
Netwin ≫ Surgemail Version1.9
Netwin ≫ Surgemail Version1.9b2
Netwin ≫ Surgemail Version2.0a2
Netwin ≫ Surgemail Version2.0c
Netwin ≫ Surgemail Version2.0e
Netwin ≫ Surgemail Version2.0g2
Netwin ≫ Surgemail Version2.1a
Netwin ≫ Surgemail Version2.1c7
Netwin ≫ Surgemail Version2.2a6
Netwin ≫ Surgemail Version2.2c9
Netwin ≫ Surgemail Version2.2c10
Netwin ≫ Surgemail Version2.2g2
Netwin ≫ Surgemail Version2.2g3
Netwin ≫ Surgemail Version3.0a
Netwin ≫ Surgemail Version3.0c2
Netwin ≫ Surgemail Version3.1s
Netwin ≫ Surgemail Version3.2e
Netwin ≫ Surgemail Version3.5a
Netwin ≫ Surgemail Version3.5b3
Netwin ≫ Surgemail Version3.6d
Netwin ≫ Surgemail Version3.6f3
Netwin ≫ Surgemail Version3.6f5
Netwin ≫ Surgemail Version3.6f7
Netwin ≫ Surgemail Version3.7b
Netwin ≫ Surgemail Version3.7b3
Netwin ≫ Surgemail Version3.7b5
Netwin ≫ Surgemail Version3.7b6
Netwin ≫ Surgemail Version3.7b7
Netwin ≫ Surgemail Version3.7b8
Netwin ≫ Surgemail Version3.8a
Netwin ≫ Surgemail Version3.8b
Netwin ≫ Surgemail Version3.8d
Netwin ≫ Surgemail Version3.8f
Netwin ≫ Surgemail Version3.8f2
Netwin ≫ Surgemail Version3.8f3
Netwin ≫ Surgemail Version3.8i
Netwin ≫ Surgemail Version3.8i2
Netwin ≫ Surgemail Version3.8i3
Netwin ≫ Surgemail Version3.8k
Netwin ≫ Surgemail Version3.8k2
Netwin ≫ Surgemail Version3.8k3
Netwin ≫ Surgemail Version3.8k4
Netwin ≫ Surgemail Version3.8m
Netwin ≫ Surgemail Version3.8o
Netwin ≫ Surgemail Version3.8q
Netwin ≫ Surgemail Version3.8s
Netwin ≫ Surgemail Version3.8u
Netwin ≫ Surgemail Version3.9a
Netwin ≫ Surgemail Version3.9c
Netwin ≫ Surgemail Version3.9e
Netwin ≫ Surgemail Version3.9g
Netwin ≫ Surgemail Version3.9g2
Netwin ≫ Surgemail Version4.0a
Netwin ≫ Surgemail Version4.0k
Netwin ≫ Surgemail Version4.0u3
Netwin ≫ Surgemail Version4.0u4
Netwin ≫ Surgemail Version4.0v-8
Netwin ≫ Surgemail Version4.2a2-2
Netwin ≫ Surgemail Version4.2a2-3
Netwin ≫ Surgemail Version4.2a3-3
Netwin ≫ Surgemail Version4.2d-1
Netwin ≫ Surgemail Version4.2d2-2
Netwin ≫ Surgemail Version4.2d3-3
Netwin ≫ Surgemail Versionbeta_3.9a
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.09% 0.86
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://ictsec.se/?p=108
Exploit
http://secunia.com/advisories/41685
Vendor Advisory
http://www.securityfocus.com/archive/1/514115/100/0/threaded
http://www.securityfocus.com/bid/43679
Exploit
https://www.exploit-db.com/exploits/34797/