CVE-2010-0132

Published: Mar 31, 2010Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to "search_re input," a different vulnerability than CVE-2010-0736.

Affected (16)

Products: Viewvc: Viewvc

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Viewvc Viewvc	Version 1.0.0
Viewvc Viewvc	Version 1.0.10
Viewvc Viewvc	Version 1.0.1
Viewvc Viewvc	Version 1.0.2
Viewvc Viewvc	Version 1.0.3
Viewvc Viewvc	Version 1.0.4
Viewvc Viewvc	Version 1.0.5
Viewvc Viewvc	Version 1.0.6
Viewvc Viewvc	Version 1.0.7
Viewvc Viewvc	Version 1.0.8
Viewvc Viewvc	Version 1.0.9
Viewvc Viewvc	Version 1.1.0
Viewvc Viewvc	Version 1.1.1
Viewvc Viewvc	Version 1.1.2
Viewvc Viewvc	Version 1.1.3
Viewvc Viewvc	Version 1.1.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (20)

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038420.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038456.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038925.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/38918

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/secunia_research/2010-26/

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2342&r2=2359&pathrev=HEAD

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/archive/1/510408/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

http://www.vupen.com/english/advisories/2010/0743

Source: PSIRT-CNA@flexerasoftware.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/0844

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038420.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038456.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038925.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38918

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/secunia_research/2010-26/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2342&r2=2359&pathrev=HEAD

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/510408/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0743

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/0844

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.