CVE-2007-6726

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-buildsPatch, Vendor Advisory
http://www.dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediatelyPatch, Vendor Advisory
http://www.dojotoolkit.org/releaseNotes/0.4.3Patch, Vendor Advisory
http://www.securityfocus.com/bid/34660
https://exchange.xforce.ibmcloud.com/vulnerabilities/49884
https://issues.apache.org/struts/browse/WW-2134Vendor Advisory
http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-buildsPatch, Vendor Advisory
http://www.dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediatelyPatch, Vendor Advisory
http://www.dojotoolkit.org/releaseNotes/0.4.3Patch, Vendor Advisory
http://www.securityfocus.com/bid/34660
https://exchange.xforce.ibmcloud.com/vulnerabilities/49884
https://issues.apache.org/struts/browse/WW-2134Vendor Advisory

Timeline

Published: Apr 9, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-67277.5SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum param CVE-2007-67284.3Cross-site scripting (XSS) vulnerability in XMB 1.5 allows remote attackers to inject arbitrary web script or HTML via the MSN field during CVE-2007-67294.3Cross-site scripting (XSS) vulnerability in the web management interface in the ZyXEL P-330W router allows remote attackers to inject arbitr CVE-2007-67309.3Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in the ZyXEL P-330W router allow remote attackers CVE-2007-673110.0Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which CVE-2007-673210.0Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attacke CVE-2007-67334.7The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group CVE-2007-67344.0NWFTPD.nlm before 5.08.07 in the FTP server in Novell NetWare 6.5 SP7 does not properly implement the FTPREST.TXT NOREMOTE restriction, whic CVE-2007-67357.5NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TX CVE-2007-67366.5Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary CVE-2007-67377.5FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, CVE-2007-67385.0pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attack