CVE

Id
16035  
CVE No.
CVE-2005-4831  
Status
Candidate  
Description
viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other attacks, as demonstrated using (1) "text/html", or (2) "image/jpeg" with an image that is rendered as HTML by Internet Explorer, a different vulnerability than CVE-2004-1062. NOTE: it was later reported that 0.9.4 is also affected.  
Phase
Assigned (20070303)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
125969 16035 CVE-2005-4831 BUGTRAQ:20070226 ViewCVS 0.9.4 issues  View
125970 16035 CVE-2005-4831 URL:http://www.securityfocus.com/archive/1/archive/1/461382/100/0/threaded  View
125971 16035 CVE-2005-4831 FULLDISC:20050101 Two Vulnerabilities in ViewCVS  View
125972 16035 CVE-2005-4831 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030514.html  View
125973 16035 CVE-2005-4831 BID:12112  View
125974 16035 CVE-2005-4831 URL:http://www.securityfocus.com/bid/12112  View
125975 16035 CVE-2005-4831 SECTRACK:1017704  View

Related JVN