CVE

Id
43016  
CVE No.
CVE-2010-0432  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.  
Phase
Assigned (20100127)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
469058 43016 CVE-2010-0432 MISC:http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.php  View
469059 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920369  View
469060 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920370  View
469061 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920371  View
469062 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920372  View
469063 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920379  View
469064 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920380  View
469065 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920381  View
469066 43016 CVE-2010-0432 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=920382  View
469067 43016 CVE-2010-0432 BID:39489  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
35663 JVNDB-2010-001443 KDE の KDM における制御ソケットの処理に関する権限昇格の脆弱性 KDE の KDM には、制御ソケットの処理に関して不備がある為、権限を取得される脆弱性が存在します。 CVE-2010-0436 43016 6.9 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001443.html  View