PRIOn knowledge basePRION:CVE-2010-2265Cross site scripting
6.4 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.113 Low
EPSS
Percentile
95.1%
Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.
| CPE | Name | Operator | Version |
|---|---|---|---|
| windows_xp | eq | sp2x64 |
References
archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html
blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx
blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx
secunia.com/advisories/40076
www.kb.cert.org/vuls/id/578319
www.microsoft.com/technet/security/advisory/2219475.mspx
www.securityfocus.com/archive/1/511774/100/0/threaded
www.securityfocus.com/bid/40721
www.vupen.com/english/advisories/2010/1417
exchange.xforce.ibmcloud.com/vulnerabilities/59267
Related
6.4 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.113 Low
EPSS
Percentile
95.1%