CVE-2010-1104
Moderate severity vulnerability that affects Zope2
CVE-2010-1104 is a medium vulnerability (CVSS 4.3) in Zope, published March 25, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in zope2 2.8.12.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.96%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.8.12zope2 +10 more
Description
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2PyPI | 2.8.0 up to 2.8.12 | 2.8.12 |
zope2PyPI | 2.9.0 up to 2.9.12 | 2.9.12 |
zope2PyPI | 2.10.0 up to 2.10.11 | 2.10.11 |
zope2PyPI | 2.11.0 up to 2.11.6 | 2.11.6 |
zope2PyPI | 2.12.0 up to 2.12.3 | 2.12.3 |
zope2PyPI | 2.12.0 up to 2.12.3, plus listed versions 2.12.12.12.2 | 2.12.3 |
zope2PyPI | 2.8.0 up to 2.8.12, 2.9.0 up to 2.9.12, 2.10.0 up to 2.10.11, 2.11.0 up to 2.11.6, 2.12.0 up to 2.12.3, plus listed versions 2.12.12.12.2 | 2.8.122.9.122.10.112.11.62.12.3 |
congaRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.12.2-51.el5 | 0:0.12.2-51.el5 |
conga-debuginfoRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.12.2-51.el5 | 0:0.12.2-51.el5 |
luciRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.12.2-51.el5 | 0:0.12.2-51.el5 |
ricciRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.12.2-51.el5 | 0:0.12.2-51.el5 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
CVE-2010-1104- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
CVE-2010-1104- Updated
- 2026-11-02
EUVDEUVD-2018-0324No score
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
EUVD-2018-0324- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7q8-wvvh-c97pNo score
Moderate severity vulnerability that affects Zope2
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
GHSA-v7q8-wvvh-c97p- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-v7q8-wvvh-c97pNo score
Moderate severity vulnerability that affects Zope2
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
GHSA-v7q8-wvvh-c97p- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-765No score
Moderate severity vulnerability that affects Zope2
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
- Record
PYSEC-2026-765- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2010/0104
securityfocus.com/bid/37765
osvdb.org/61655
exchange.xforce.ibmcloud.com/vulnerabilities/55599
mail.zope.org/pipermail/zope-announce/2010-January/002229.html
secunia.com/advisories/38007
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2010-1104
github.com/advisories/GHSA-v7q8-wvvh-c97p
pypi.org/project/zope2
access.redhat.com/errata/RHSA-2012:0151
bugzilla.redhat.com/show_bug.cgi?id=577019
docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.8_Technical_Notes/conga.html
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0151.json
cve.org/CVERecord?id=CVE-2010-1104