Unscored severity · published Aug 15, 2012
CVE-2012-4037
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) created by, or (3) name field in a torrent file.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Transmission · Transmissionbt
through 2.60; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4037
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2012-07/0349.html
Vendor Advisory
http://secunia.com/advisories/50027
secunia.com
http://secunia.com/advisories/50769
Exploit
http://www.madirish.net/541
www.securityfocus.com
http://www.securityfocus.com/bid/54705
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1584-1
More from Transmission
9.8
CVE-2010-0748
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link
8.8
CVE-2018-5702
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary…
8.8
CVE-2010-0012
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a
7.8
CVE-2018-10756
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a…
5.3
CVE-2010-0749
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame