CVE-2010-2422

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_htmlPatch, Vendor Advisory
http://secunia.com/advisories/40270Vendor Advisory
http://www.securityfocus.com/bid/40999
http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_htmlPatch, Vendor Advisory
http://secunia.com/advisories/40270Vendor Advisory
http://www.securityfocus.com/bid/40999

Timeline

Published: Jun 24, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-24256.5Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows CVE-2010-24264.0Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows CVE-2010-24274.4VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors.CVE-2010-24284.3Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and e CVE-2010-24294.3Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbi CVE-2010-24312.6The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink atta CVE-2010-24325.0The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a dema CVE-2010-24334.3Multiple cross-site scripting (XSS) vulnerabilities in content/internalError.jsp in IBM WebSphere ILOG JRules 6.7 allow remote attackers to CVE-2010-24349.3Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code v CVE-2010-24355.0Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HT CVE-2010-24367.5SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary S CVE-2010-24374.3Cross-site scripting (XSS) vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject