CVE

Id
10837  
CVE No.
CVE-2004-2411  
Status
Candidate  
Description
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.  
Phase
Assigned (20050818)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
75584 10837 CVE-2004-2411 FULLDISC:20040613 VP-ASP Shopping Cart Multiple Vulnerabilities  View
75585 10837 CVE-2004-2411 URL:http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0363.html  View
75586 10837 CVE-2004-2411 MISC:http://www.providesecurity.com/research/advisories/06142004-01.asp  View
75587 10837 CVE-2004-2411 CONFIRM:http://www.vpasp.com/virtprog/info/faq_securityfixes.htm  View
75588 10837 CVE-2004-2411 BID:10530  View
75589 10837 CVE-2004-2411 URL:http://www.securityfocus.com/bid/10530  View
75590 10837 CVE-2004-2411 BID:10534  View
75591 10837 CVE-2004-2411 URL:http://www.securityfocus.com/bid/10534  View
75592 10837 CVE-2004-2411 OSVDB:6949  View
75593 10837 CVE-2004-2411 URL:http://www.osvdb.org/6949  View
75594 10837 CVE-2004-2411 SECUNIA:11846  View
75595 10837 CVE-2004-2411 URL:http://secunia.com/advisories/11846  View
75596 10837 CVE-2004-2411 XF:vpasp-shoperror-xss(16411)  View

Related JVN