Search
Find a vulnerability
Search criteria
6 vulnerabilities by Xapian
CVE-2026-77643 (GCVE-0-2026-77643)
Vulnerability from nvd – Published: 2026-08-20 21:23 – Updated: 2026-08-28 18:08
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in
queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xapian | xapian-core |
Affected:
2.0.0 , < 2.1.0
(semver)
Affected: 0 , < 1.4.32 (semver) cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77643",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:08:22.966488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:08:32.929Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "xapian-core",
"vendor": "Xapian",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThan": "1.4.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:23:31.317Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://bugs.debian.org/1144490"
},
{
"url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"
},
{
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77643",
"datePublished": "2026-08-20T21:23:31.317Z",
"dateReserved": "2026-08-20T21:23:30.985Z",
"dateUpdated": "2026-08-28T18:08:32.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-0499 (GCVE-0-2018-0499)
Vulnerability from nvd – Published: 2018-07-02 12:00 – Updated: 2024-08-05 03:28
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3709-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.xapian.org/pipermail/xapian-discuss… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xapian xapian-core before 1.4.6 |
Affected:
Xapian xapian-core before 1.4.6
|
Date Public
2018-07-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.931Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xapian xapian-core before 1.4.6",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xapian xapian-core before 1.4.6"
}
]
}
],
"datePublic": "2018-07-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-11T09:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xapian xapian-core before 1.4.6",
"version": {
"version_data": [
{
"version_value": "Xapian xapian-core before 1.4.6"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02",
"refsource": "CONFIRM",
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"name": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html",
"refsource": "CONFIRM",
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0499",
"datePublished": "2018-07-02T12:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:28:10.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2947 (GCVE-0-2009-2947)
Vulnerability from nvd – Published: 2009-09-14 16:00 – Updated: 2024-09-16 16:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/36317 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/36693 | third-party-advisoryx_refsource_SECUNIA |
| http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/… | x_refsource_CONFIRM |
| http://lists.xapian.org/pipermail/xapian-discuss/… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/36674 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2009/dsa-1882 | vendor-advisoryx_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-09-14T16:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-2947",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36317",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36693"
},
{
"name": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS",
"refsource": "CONFIRM",
"url": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"refsource": "MLIST",
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1882"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-2947",
"datePublished": "2009-09-14T16:00:00.000Z",
"dateReserved": "2009-08-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:43:31.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-77643 (GCVE-0-2026-77643)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:23 – Updated: 2026-08-28 18:08
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in
queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xapian | xapian-core |
Affected:
2.0.0 , < 2.1.0
(semver)
Affected: 0 , < 1.4.32 (semver) cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77643",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:08:22.966488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:08:32.929Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "xapian-core",
"vendor": "Xapian",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThan": "1.4.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:23:31.317Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://bugs.debian.org/1144490"
},
{
"url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"
},
{
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77643",
"datePublished": "2026-08-20T21:23:31.317Z",
"dateReserved": "2026-08-20T21:23:30.985Z",
"dateUpdated": "2026-08-28T18:08:32.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-0499 (GCVE-0-2018-0499)
Vulnerability from cvelistv5 – Published: 2018-07-02 12:00 – Updated: 2024-08-05 03:28
VLAI
EPSS
VEX
Summary
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3709-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.xapian.org/pipermail/xapian-discuss… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xapian xapian-core before 1.4.6 |
Affected:
Xapian xapian-core before 1.4.6
|
Date Public
2018-07-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.931Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xapian xapian-core before 1.4.6",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xapian xapian-core before 1.4.6"
}
]
}
],
"datePublic": "2018-07-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-11T09:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xapian xapian-core before 1.4.6",
"version": {
"version_data": [
{
"version_value": "Xapian xapian-core before 1.4.6"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet()."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02",
"refsource": "CONFIRM",
"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02"
},
{
"name": "USN-3709-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3709-1/"
},
{
"name": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html",
"refsource": "CONFIRM",
"url": "https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0499",
"datePublished": "2018-07-02T12:00:00.000Z",
"dateReserved": "2017-11-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:28:10.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2947 (GCVE-0-2009-2947)
Vulnerability from cvelistv5 – Published: 2009-09-14 16:00 – Updated: 2024-09-16 16:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/36317 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/36693 | third-party-advisoryx_refsource_SECUNIA |
| http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/… | x_refsource_CONFIRM |
| http://lists.xapian.org/pipermail/xapian-discuss/… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/36674 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2009/dsa-1882 | vendor-advisoryx_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-09-14T16:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36317",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36693"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1882"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-2947",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36317",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36317"
},
{
"name": "36693",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36693"
},
{
"name": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS",
"refsource": "CONFIRM",
"url": "http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS"
},
{
"name": "[xapian-discuss] 20090909 Cross-site scripting issue in Omega",
"refsource": "MLIST",
"url": "http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html"
},
{
"name": "36674",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36674"
},
{
"name": "DSA-1882",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1882"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-2947",
"datePublished": "2009-09-14T16:00:00.000Z",
"dateReserved": "2009-08-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:43:31.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}