CVE-2010-0736

NONE EPSS 74.3%
Published Mar 19, 201016y ago · Modified Jun 16, 20262w ago
Find Similar
Published Mar 19, 2010 16y ago
Last Modified Jun 16, 2026 2w ago

Description

Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."

Threat Intelligence

EPSS Exploit Probability
74.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 13

VendorProductVersionRange
viewvcviewvc* ≤1.0.9
viewvcviewvc1.0.1any
viewvcviewvc1.0.2any
viewvcviewvc1.0.3any
viewvcviewvc1.0.4any
viewvcviewvc1.0.5any
viewvcviewvc1.0.6any
viewvcviewvc1.0.7any
viewvcviewvc1.0.8any
viewvcviewvc1.1.0any
viewvcviewvc1.1.1any
viewvcviewvc1.1.2any
viewvcviewvc1.1.3any

References 4

  • viewvc.tigris.org http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2313&r2=2342&pathrev=HEAD
  • viewvc.tigris.org http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2326
    Patch
  • openwall.com http://www.openwall.com/lists/oss-security/2010/03/10/8
    Patch
  • openwall.com http://www.openwall.com/lists/oss-security/2010/03/16/14
    Patch

Remediation

  • viewvc.tigris.org http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2326
    Patch
  • openwall.com http://www.openwall.com/lists/oss-security/2010/03/10/8
    Patch
  • openwall.com http://www.openwall.com/lists/oss-security/2010/03/16/14
    Patch