vulnwire
7.6high

CVE-2007-1085in critical feed1 exploit

Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web sc…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
11.1%
percentile 96%
Public exploits
1
Exploit-DB

Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by using an XSS vulnerability in google.com to extract the signature for the internal web server, then calling the "under" parameter in Advanced Search with the proper signature.

Exploit prediction (EPSS)

11.09% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-29623 Google Desktop - Cross-Site Scripting · webapps · 2007-02-21

CVSS scores

Assigned byVersionScoreVector
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C

References

  • securitytracker.com /id?1017686 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • watchfire.com /resources/Overtaking-Google-Desktop.pdf · x_refsource_MISC, x_transferred
  • securityfocus.com /archive/1/460735/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/460928/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • kb.cert.org /vuls/id/615857 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityreason.com /securityalert/2301 · third-party-advisory, x_refsource_SREASON, x_transferred
  • securityfocus.com /bid/22650 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /33483 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.