CVE-2001-0828

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html
http://www.caucho.com/products/resin/changes.xtpVendor Advisory
http://www.kb.cert.org/vuls/id/981651US Government Resource
http://www.osvdb.org/1890
http://www.securityfocus.com/bid/2981Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6793
http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html
http://www.caucho.com/products/resin/changes.xtpVendor Advisory
http://www.kb.cert.org/vuls/id/981651US Government Resource
http://www.osvdb.org/1890
http://www.securityfocus.com/bid/2981Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6793

Timeline

Published: Dec 6, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-08295.1A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, w CVE-2001-08307.56tunnel 0.08 and earlier does not properly close sockets that were initiated by a client, which allows remote attackers to cause a denial of CVE-2001-08314.6Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SET_LABEL, or SQL*Predicate is being use CVE-2001-08322.1Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorr CVE-2001-08337.2Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment var CVE-2001-08346.4htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuratio CVE-2001-08357.5Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags CVE-2001-08367.5Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2001-08372.1DeltaThree Pc-To-Phone 3.0.3 places sensitive data in world-readable locations in the installation directory, which allows local users to re CVE-2001-08387.5Format string vulnerability in Network Solutions Rwhoisd 1.5.x allows remote attackers to execute arbitrary code via format string specifier CVE-2001-08397.5ibillpm.pl in iBill password management system generates weak passwords based on a client's MASTER_ACCOUNT, which allows remote attackers to CVE-2001-084010.0Buffer overflow in Compaq Insight Manager XE 2.1b and earlier allows remote attackers to execute arbitrary code via (1) SNMP and (2) DMI.