CVE-2010-1104
Zope 2.8.x-2.8.11, 2.9.x-2.9.11, 2.10.x-2.10.10, 2.11.x-2.11.5, 2.12.x-2.12.2 - Cross-Site Scripting via Error Message
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
References (6)
Core 6
Core References
Patch, Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0104
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/37765
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/61655
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/55599
Patch, Vendor Advisory mailing-list
x_refsource_mlist
https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/38007
Scores
EPSS
0.0195
EPSS Percentile
78.1%
Details
CWE
CWE-79
Status
published
Products (50)
pypi/Zope2
2.8.0 - 2.8.12PyPI
zope/zope
2.8
zope/zope
2.8.0
zope/zope
2.8.0-a1
zope/zope
2.8.0-a2
zope/zope
2.8.0-b1
zope/zope
2.8.0-b2
zope/zope
2.8.0-final
zope/zope
2.8.1
zope/zope
2.8.1-b1
... and 40 more
Published
Mar 25, 2010
Tracked Since
Feb 18, 2026