CVE-2010-1448

Published: Jun 24, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element, a different vulnerability than CVE-2009-4497 and CVE-2010-1625.

Affected (12)

Products: Malcom Box: Lxr Cross Referencer

1 product

Lxr Cross Referencer

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Malcom Box Lxr Cross Referencer	Up to 0.9.7
Malcom Box Lxr Cross Referencer	Version 0.3.1
Malcom Box Lxr Cross Referencer	Version 0.3
Malcom Box Lxr Cross Referencer	Version 0.7
Malcom Box Lxr Cross Referencer	Version 0.8
Malcom Box Lxr Cross Referencer	Version 0.9.1
Malcom Box Lxr Cross Referencer	Version 0.9.2
Malcom Box Lxr Cross Referencer	Version 0.9.3
Malcom Box Lxr Cross Referencer	Version 0.9.4
Malcom Box Lxr Cross Referencer	Version 0.9.5
Malcom Box Lxr Cross Referencer	Version 0.9.6
Malcom Box Lxr Cross Referencer	Version 0.9

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (28)

http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?r1=1.63&r2=1.64

Source: secalert@redhat.com

Patch

http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?view=log#rev1.64

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=127289957223005&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=127291817517567&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=127316953819027&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/39686

Source: secalert@redhat.com

http://sourceforge.net/projects/lxr/files/stable/lxr-0.9.8/lxr-0.9.8.tgz/download

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2010/05/03/1

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/05/03/7

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/05/06/2

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/05/14/3

Source: secalert@redhat.com

http://www.osvdb.org/64216

Source: secalert@redhat.com

http://www.securityfocus.com/bid/39865

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/58294

Source: secalert@redhat.com

http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?r1=1.63&r2=1.64

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?view=log#rev1.64

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=oss-security&m=127289957223005&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=oss-security&m=127291817517567&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=oss-security&m=127316953819027&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/39686

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/projects/lxr/files/stable/lxr-0.9.8/lxr-0.9.8.tgz/download

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.openwall.com/lists/oss-security/2010/05/03/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/05/03/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/05/06/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/05/14/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/64216

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/39865

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/58294

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.