2.6

CVE-2011-4940

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version <= 2.5.6
Python ≫ Python Version0.9.0
Python ≫ Python Version0.9.1
Python ≫ Python Version1.2
Python ≫ Python Version1.3
Python ≫ Python Version1.5.2
Python ≫ Python Version1.6
Python ≫ Python Version1.6.1
Python ≫ Python Version2.0.1
Python ≫ Python Version2.1.1
Python ≫ Python Version2.1.2
Python ≫ Python Version2.1.3
Python ≫ Python Version2.2.1
Python ≫ Python Version2.2.2
Python ≫ Python Version2.2.3
Python ≫ Python Version2.3.1
Python ≫ Python Version2.3.2
Python ≫ Python Version2.3.3
Python ≫ Python Version2.3.4
Python ≫ Python Version2.3.5
Python ≫ Python Version2.3.7
Python ≫ Python Version2.4.1
Python ≫ Python Version2.4.2
Python ≫ Python Version2.4.3
Python ≫ Python Version2.4.4
Python ≫ Python Version2.4.6
Python ≫ Python Version2.5.1
Python ≫ Python Version2.5.2
Python ≫ Python Version2.5.3
Python ≫ Python Version2.5.4
Python ≫ Python Version2.6.1
Python ≫ Python Version2.6.2
Python ≫ Python Version2.6.3
Python ≫ Python Version2.6.4
Python ≫ Python Version2.6.5
Python ≫ Python Version2.6.6
Python ≫ Python Version2.7.1
Python ≫ Python Version2.7.1 Updaterc1
Python ≫ Python Version2.7.2 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.634
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.