XSS in Secureideas Basic Analysis And Security Engine
CVE-2009-4837
Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php. NOTE: some of these details are obtained from third party information.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.011 (62.2th percentile) — read the EPSS interpretation.
Affected products
- Secureideas Basic_analysis_and_security_engine — versions 1.2.1, 1.2.4, 1.1.4
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM)