CVE-2010-1137
VMware VirtualCenter 2.0.2 and 2.5 - Cross-Site Scripting via Virtual Machine Name
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows remote attackers to inject arbitrary web script or HTML via the name of a virtual machine.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6863
Patch, Vendor Advisory mailing-list
x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2010/000086.html
Patch, Vendor Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2010-0005.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1023769
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/39037
Third Party Advisory vendor-advisory
x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201209-25.xml
Scores
EPSS
0.0069
EPSS Percentile
72.0%
Details
CWE
CWE-79
Status
published
Products (5)
vmware/esx_server
3.0.3
vmware/esx_server
3.5
vmware/server
1.0
vmware/virtualcenter
2.0.2
vmware/virtualcenter
2.5
Published
Apr 01, 2010
Tracked Since
Feb 18, 2026