CVE-2009-5145

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cve.killedkenny.io/cve/CVE-2009-5145Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/02/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72792/infoThird Party Advisory, VDB Entry
https://bugs.launchpad.net/zope2/+bug/490514Issue Tracking, Third Party Advisory
https://github.com/zopefoundation/Zope/commit/2abdf14620f146857dc8e3ffd2b6a754884c331dThird Party Advisory
https://security-tracker.debian.org/tracker/CVE-2009-5145/Third Party Advisory
http://cve.killedkenny.io/cve/CVE-2009-5145Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/02/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72792/infoThird Party Advisory, VDB Entry
https://bugs.launchpad.net/zope2/+bug/490514Issue Tracking, Third Party Advisory
https://github.com/zopefoundation/Zope/commit/2abdf14620f146857dc8e3ffd2b6a754884c331dThird Party Advisory
https://security-tracker.debian.org/tracker/CVE-2009-5145/Third Party Advisory

Timeline

Published: Aug 7, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-51477.3DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.CVE-2009-51494.3Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, whi CVE-2009-51506.7Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set u CVE-2009-51516.7The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signat CVE-2009-51524.1Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configura CVE-2009-51539.8In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allo CVE-2009-51549.8An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account.CVE-2009-51557.5In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to ca CVE-2009-51569.8An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.CVE-2009-51578.8On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variab CVE-2009-51586.1The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.CVE-2009-51596.1Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.