Unscored severity · published Mar 12, 2009
CVE-2009-0877
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express allow remote attackers to inject arbitrary web script or HTML via the (1) Full Name…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express allow remote attackers to inject arbitrary web script or HTML via the (1) Full Name or (2) Subject field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java System Communications Express · Sun
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0877
osvdb.org
http://osvdb.org/52718
Exploit
http://sosoblood.freehostia.com/SJSC/html_injection.gif
www.securityfocus.com
http://www.securityfocus.com/archive/1/501672/100/0/threaded
Exploit
http://www.securityfocus.com/bid/34083
More from Java System Communications Express
–
CVE-2010-4456
Unspecified vulnerability in Oracle Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to affect integrity via unknown vectors related to Web Mail
–
CVE-2010-1227
Cross-site scripting (XSS) vulnerability in Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via the subject field…
–
CVE-2009-1729
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or…
–
CVE-2005-3472
Unspecified vulnerability in Sun Java System Communications Express 2005Q1 and 2004Q2 allows local and remote attackers to read sensitive information from configuration files