CVE-2009-5120

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-16

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-51215.0Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword CVE-2009-51225.0The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive informatiCVE-2009-51234.3The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consCVE-2009-51244.3The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (applicationCVE-2009-51254.3Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manipCVE-2009-51264.3The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application cCVE-2009-51274.3The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application cCVE-2009-51285.0The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via aCVE-2009-51295.0The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) viCVE-2009-51304.3The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachmeCVE-2009-51315.0The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackeCVE-2009-51325.0The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a d