{"id":"CVE-2009-2947","aliases":["DEBIAN-CVE-2009-2947","DSA-1882-1","EUVD-2009-2934","GHSA-73qv-xhr2-28jm"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.019,"percentile":0.79818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2009-09-09T00:00:00Z","modified":"2026-10-23T17:47:27Z","fixes":[{"ecosystem":"Debian:12","package":"xapian-omega","fixed_in":["1.0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xapian-omega","fixed_in":["1.0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xapian-omega","fixed_in":["1.0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:4.0","package":"xapian-omega","fixed_in":["0.9.9-1+etch1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"xapian-omega","fixed_in":["1.0.7-3+lenny1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xapian-omega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xapian-omega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xapian-omega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"xapian-omega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-1+etch1"}]}],"versions":["0.9.9-1"]},{"source":"osv","ecosystem":"Debian:5.0","package":"xapian-omega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3+lenny1"}]}],"versions":["1.0.7-3"]}],"products":[{"vendor":"xapian","product":"omega"}],"references":[{"url":"http://www.securityfocus.com/bid/36317","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/36693","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://svn.xapian.org/%2Acheckout%2A/tags/1.0.16/xapian-applications/omega/NEWS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/36674","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1882","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2947"},{"url":"http://svn.xapian.org/*checkout*/tags/1.0.16/xapian-applications/omega/NEWS"},{"url":"https://github.com/advisories/GHSA-73qv-xhr2-28jm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-2947","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-2947","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2009-09-14T16:00:00Z","modified":"2024-09-16T16:43:31.029Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2009-2934","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2009-09-14T16:00:00Z","modified":"2024-09-16T16:43:31Z","updated_at":"2026-11-03T00:55:48.659023Z"}],"ghsa":[{"id":"GHSA-73qv-xhr2-28jm","title":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2022-05-02T03:40:12Z","modified":"2025-04-09T04:15:27Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:01.075702Z"}],"nvd":[{"id":"CVE-2009-2947","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2009-09-14T16:30:00.5Z","modified":"2026-06-16T23:10:33.357Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:36.596719Z"}],"osv":[{"id":"CVE-2009-2947","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2009-09-14T16:30:00Z","modified":"2026-04-10T03:40:52.796343Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-2947","description":"Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.","status":"published","published":"2009-09-14T16:30:00.5Z","modified":"2026-10-23T17:47:27.847436573Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1882-1","title":"xapian-omega - cross-site scripting","status":"published","published":"2009-09-09T00:00:00Z","modified":"2026-03-09T01:22:33.895352Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}