Published: 04/02/2011 Updated: 09/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in PivotX 2.2.0, and possibly other versions prior to 2.2.2, allow remote malicious users to inject arbitrary web script or HTML via the (1) color parameter to includes/blogroll.php or (2) src parameter to includes/timwrapper.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pivotx pivotx 2.1.1
pivotx pivotx 2.1.0
pivotx pivotx 2.2.1
pivotx pivotx 2.2.0
pivotx pivotx 2.1.2

source: wwwsecurityfocuscom/bid/45996/info PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may let the attack ...

source: wwwsecurityfocuscom/bid/45996/info PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may let the attacker ...

CWE-79 http://www.securityfocus.com/bid/45996 http://secunia.com/advisories/43040 http://www.osvdb.org/70674 http://www.htbridge.ch/advisory/xss_in_pivotx_1.html http://www.osvdb.org/70673 http://www.htbridge.ch/advisory/xss_in_pivotx.html http://blog.pivotx.net/archive/2011/01/11/pivotx-222-released http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3409 http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3410 http://securityreason.com/securityalert/8062 https://exchange.xforce.ibmcloud.com/vulnerabilities/64975 http://www.securityfocus.com/archive/1/515964/100/0/threaded http://www.securityfocus.com/archive/1/515958/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/35260/

CVE-2011-0772

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect