Unscored severity · published Nov 22, 2005
CVE-2005-3754
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and possibly other web script or HTML, via the proxystylesheet variable, which will be executed in the resulting error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mini Search Appliance · Google
All versions, or not specified · source: NVD
SA
Search Appliance · Google
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3754
Vendor Advisory
http://metasploit.com/research/vulns/google_proxystylesheet/
Vendor Advisory
http://secunia.com/advisories/17644
Exploit
http://securitytracker.com/id?1015246
Patch
http://www.osvdb.org/20978
www.securityfocus.com
http://www.securityfocus.com/archive/1/417310/30/0/threaded
Patch
http://www.securityfocus.com/bid/15509
More from Mini Search Appliance
–
CVE-2007-5255
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search…
–
CVE-2006-6223
Cross-site scripting (XSS) vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter
–
CVE-2006-5019
Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter, which reveals the…
–
CVE-2005-3757
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via…
–
CVE-2005-3758
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and…