CVE-2004-1062

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.htmlVendor Advisory
http://security.gentoo.org/glsa/glsa-200412-26.xmlPatch, Vendor Advisory
http://www.mikx.de/index.php?p=6Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_01_sr.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/18718
http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.htmlVendor Advisory
http://security.gentoo.org/glsa/glsa-200412-26.xmlPatch, Vendor Advisory
http://www.mikx.de/index.php?p=6Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_01_sr.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/18718

Timeline

Published: Dec 28, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-106310.0PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_CVE-2004-106410.0The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which CVE-2004-106510.0Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary cod CVE-2004-10663.6The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3, and (2) linprocfs on FreeBSD 5.x through 5.3, do not properly validate a p CVE-2004-106710.0Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote CVE-2004-10686.2A "missing serialization" error in the unix_dgram_recvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to CVE-2004-10691.2Race condition in SELinux 2.6.x through 2.6.9 allows local users to cause a denial of service (kernel crash) via SOCK_SEQPACKET unix domain CVE-2004-10707.2The load_elf_binary function in the binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not pro CVE-2004-10717.2The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not properly handle a failed call to th CVE-2004-10727.2The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, may create an interpreter name string that i CVE-2004-10732.1The open_exec function in the execve functionality (exec.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, allows local users to CVE-2004-10742.1The binfmt functionality in the Linux kernel, when "memory overcommit" is enabled, allows local users to cause a denial of service (kernel o