Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-3936 | First vendor Publication | 2010-11-09 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3936 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12218 | |||
| Oval ID: | oval:org.mitre.oval:def:12218 | ||
| Title: | XSS in Signurl.asp Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3936 | Version: | 3 |
| Platform(s): | Microsoft Windows Server 2008 | Product(s): | Forefront Unified Access Gateway 2010 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 69095 | Microsoft Forefront Unified Access Gateway (UAG) Signurl.asp XSS Forefront Unified Access Gateway contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because Unspecified input passed to Signurl.asp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. It can allow an attacker to issue commands to the UAG server in the context of the targeted user. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2010-11-10 | IAVM : 2010-A-0159 - Multiple Vulnerabilities in Microsoft Forefront Unified Access Gateway (UAG) Severity : Category II - VMSKEY : V0025710 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Forefront UAG URL XSS alternate attempt RuleID : 18076 - Revision : 11 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows Forefront UAG URL XSS attempt RuleID : 18074 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Forefront UAG arbitrary embedded scripting attempt RuleID : 18073 - Revision : 10 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Forefront UAG external redirect attempt RuleID : 18072 - Revision : 9 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-11-09 | Name : An application on the remote host has multiple vulnerabilities File : smb_nt_ms10-089.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:06:58 |
|
| 2024-11-28 12:23:21 |
|
| 2021-05-04 12:12:40 |
|
| 2021-04-22 01:13:21 |
|
| 2020-05-23 00:26:45 |
|
| 2018-10-13 00:23:01 |
|
| 2017-09-19 09:24:01 |
|
| 2016-04-26 20:11:02 |
|
| 2014-02-17 10:58:12 |
|
| 2014-01-19 21:27:12 |
|
| 2013-11-11 12:39:01 |
|
| 2013-05-10 23:35:32 |
|
