|
|
CVE Reference: CVE-2007-5120 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2007-5120 |
|
|
Description: Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1) group and (2) members parameters in (a) NewGroup.jsp; the (3) edittime parameter in (b) Edit.jsp; the (4) edittime, (5) author, and (6) link parameters in (c) Comment.jsp; the (7) loginname, (8) wikiname, (9) fullname, and (10) email parameters in (d) UserPreferences.jsp and (e) Login.jsp; the (11) r1 and (12) r2 parameters in (f) Diff.jsp; and the (13) changenote parameter in (g) PageInfo.jsp. |
|
|
CVE Status: Candidate |
|
|
References: XF http://xforce.iss.net/xforce/xfdb/36766 SREASON http://securityreason.com/securityalert/3167 SAID Secunia Advisory: SA26961 FULLDISC http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/066096.html CONFIRM http://www.ecyrd.com/~jalkanen/JSPWiki/2.4.104/ChangeLog BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/480570/100/0/threaded BID 25803 |
|
| Return to the previous page. |
