Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by xapian
CVE-2026-77643 (GCVE-0-2026-77643)
Vulnerability from nvd – Published: 2026-08-20 21:23 – Updated: 2026-08-20 21:23
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in
queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.
Severity
4.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xapian | xapian-core |
Affected:
2.0.0 , < 2.1.0
(semver)
Affected: 0 , < 1.4.32 (semver) cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "xapian-core",
"vendor": "Xapian",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThan": "1.4.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:23:31.317Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://bugs.debian.org/1144490"
},
{
"url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"
},
{
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77643",
"datePublished": "2026-08-20T21:23:31.317Z",
"dateReserved": "2026-08-20T21:23:30.985Z",
"dateUpdated": "2026-08-20T21:23:31.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-0499 (GCVE-0-2018-0499)
Vulnerability from nvd – Published: 2018-07-02 12:00 – Updated: 2024-08-05 03:28
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3709-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.xapian.org/pipermail/xapian-discuss… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xapian xapian-core before 1.4.6 |
Affected:
Xapian xapian-core before 1.4.6
|
Date Public
2018-07-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.931Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xapian xapian-core before 1.4.6",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xapian xapian-core before 1.4.6"
}
]
}
],
"datePublic": "2018-07-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-11T09:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xapian xapian-core before 1.4.6",
"version": {
"version_data": [
{
"version_value": "Xapian xapian-core before 1.4.6"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02",
"refsource": "CONFIRM",
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"name": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html",
"refsource": "CONFIRM",
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0499",
"datePublished": "2018-07-02T12:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:28:10.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2947 (GCVE-0-2009-2947)
Vulnerability from nvd – Published: 2009-09-14 16:00 – Updated: 2024-09-16 16:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/36317 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/36693 | third-party-advisoryx_refsource_SECUNIA |
| http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/… | x_refsource_CONFIRM |
| http://lists.xapian.org/pipermail/xapian-discuss/… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/36674 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2009/dsa-1882 | vendor-advisoryx_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-09-14T16:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-2947",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36317",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36693"
},
{
"name": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS",
"refsource": "CONFIRM",
"url": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"refsource": "MLIST",
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1882"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-2947",
"datePublished": "2009-09-14T16:00:00.000Z",
"dateReserved": "2009-08-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:43:31.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-77643 (GCVE-0-2026-77643)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:23 – Updated: 2026-08-20 21:23
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in
queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.
Severity
4.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xapian | xapian-core |
Affected:
2.0.0 , < 2.1.0
(semver)
Affected: 0 , < 1.4.32 (semver) cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "xapian-core",
"vendor": "Xapian",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThan": "1.4.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:23:31.317Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://bugs.debian.org/1144490"
},
{
"url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"
},
{
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77643",
"datePublished": "2026-08-20T21:23:31.317Z",
"dateReserved": "2026-08-20T21:23:30.985Z",
"dateUpdated": "2026-08-20T21:23:31.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-0499 (GCVE-0-2018-0499)
Vulnerability from cvelistv5 – Published: 2018-07-02 12:00 – Updated: 2024-08-05 03:28
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3709-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.xapian.org/pipermail/xapian-discuss… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xapian xapian-core before 1.4.6 |
Affected:
Xapian xapian-core before 1.4.6
|
Date Public
2018-07-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.931Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xapian xapian-core before 1.4.6",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xapian xapian-core before 1.4.6"
}
]
}
],
"datePublic": "2018-07-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-11T09:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xapian xapian-core before 1.4.6",
"version": {
"version_data": [
{
"version_value": "Xapian xapian-core before 1.4.6"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02",
"refsource": "CONFIRM",
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"name": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html",
"refsource": "CONFIRM",
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0499",
"datePublished": "2018-07-02T12:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:28:10.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2947 (GCVE-0-2009-2947)
Vulnerability from cvelistv5 – Published: 2009-09-14 16:00 – Updated: 2024-09-16 16:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/36317 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/36693 | third-party-advisoryx_refsource_SECUNIA |
| http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/… | x_refsource_CONFIRM |
| http://lists.xapian.org/pipermail/xapian-discuss/… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/36674 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2009/dsa-1882 | vendor-advisoryx_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-09-14T16:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-2947",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36317",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36693"
},
{
"name": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS",
"refsource": "CONFIRM",
"url": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"refsource": "MLIST",
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1882"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-2947",
"datePublished": "2009-09-14T16:00:00.000Z",
"dateReserved": "2009-08-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:43:31.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}