National Cyber Awareness System

Vulnerability Summary for CVE-2009-4168

Overview

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: joomulus-tagcloud-xss(55156)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55156

External Source: XF

Name: wpcumulus-tagcloud-xss(54397)

Hyperlink:http://xforce.iss.net/xforce/xfdb/54397

External Source: VUPEN

Name: ADV-2009-3322

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/3322

External Source: BID

Name: 37479

Hyperlink:http://www.securityfocus.com/bid/37479

External Source: BID

Name: 37100

Hyperlink:http://www.securityfocus.com/bid/37100

External Source: BUGTRAQ

Name: 20100108 Cross-Site Scripting vulnerability in JVClouds3D for Joomla

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/508833/100/0/threaded

External Source: BUGTRAQ

Name: 20091225 Vulnerability in Joomulus for Joomla

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/508606/100/0/threaded

External Source: BUGTRAQ

Name: 20091124 Vulnerabilities in WP-Cumulus for WordPress

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/508071/100/0/threaded

External Source: CONFIRM

Name: http://www.roytanck.com/2009/11/15/wp-cumulus-updated-to-address-yet-another-security-issue/

Type: Advisory

Hyperlink:http://www.roytanck.com/2009/11/15/wp-cumulus-updated-to-address-yet-another-security-issue/

External Source: MISC

Name: http://websecurity.com.ua/3839/

Hyperlink:http://websecurity.com.ua/3839/

External Source: MISC

Name: http://websecurity.com.ua/3801/

Hyperlink:http://websecurity.com.ua/3801/

External Source: MISC

Name: http://websecurity.com.ua/3789/

Hyperlink:http://websecurity.com.ua/3789/

External Source: MISC

Name: http://websecurity.com.ua/3665/

Hyperlink:http://websecurity.com.ua/3665/

External Source: SECUNIA

Name: 38161

Hyperlink:http://secunia.com/advisories/38161

External Source: SECUNIA

Name: 37483

Type: Advisory

Hyperlink:http://secunia.com/advisories/37483

External Source: MISC

Name: http://packetstormsecurity.org/1001-exploits/joomlajvclouds-xss.txt

Hyperlink:http://packetstormsecurity.org/1001-exploits/joomlajvclouds-xss.txt