CVE

Id
40168  
CVE No.
CVE-2009-2733  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.  
Phase
Assigned (20090810)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
441686 40168 CVE-2009-2733 BUGTRAQ:20091013 [BONSAI] XSS in Achievo - Customized XSS payload included  View
441687 40168 CVE-2009-2733 URL:http://www.securityfocus.com/archive/1/archive/1/507133/100/0/threaded  View
441688 40168 CVE-2009-2733 MISC:http://www.bonsai-sec.com/blog/index.php/cross-site-scripting-payloads/  View
441689 40168 CVE-2009-2733 MISC:http://www.bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt  View
441690 40168 CVE-2009-2733 CONFIRM:http://www.achievo.org/download/releasenotes/1_4_0  View
441691 40168 CVE-2009-2733 BID:36661  View
441692 40168 CVE-2009-2733 URL:http://www.securityfocus.com/bid/36661  View
441693 40168 CVE-2009-2733 SECTRACK:1023017  View
441694 40168 CVE-2009-2733 URL:http://securitytracker.com/id?1023017  View
441695 40168 CVE-2009-2733 SECUNIA:37035  View
441696 40168 CVE-2009-2733 URL:http://secunia.com/advisories/37035  View
441697 40168 CVE-2009-2733 XF:achievo-dispatchphp-xss(53745)  View
441698 40168 CVE-2009-2733 URL:http://xforce.iss.net/xforce/xfdb/53745  View
441699 40168 CVE-2009-2733 XF:achievo-title-xss(53744)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
45203 JVNDB-2009-006210 Roundup の cgi/actions.py におけるクラス内の任意の項目を変更される脆弱性 Roundup の cgi/actions.py の EditCSVAction 関数は、パーミッションを適切にチェックしないため、クラス内の任意の項目を変更される脆弱性が存在します。 CVE-2009-2737 40168 5.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-006210.html  View