Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized.

A cross-site scripting vulnerability has been discovered in namazu2, a full text search engine. An attacker could prepare specially crafted input that would not be sanitised by namazu2 and hence displayed verbatim for the victim.

The remote host is running Namazu, a web-based search engine.
The remote version of this software is vulnerable to various flaws that may allow an attacker to perform a cross-site scripting attack using the remote host or to execute arbitrary code on the remote system with the privileges of the web server. 

The remote host is running Namazu - a web-based search engine.

The remote version of this software has various flaws that may allow an attacker to perform a cross-site scripting attack using the remote host or to execute arbitrary code on the remote system with the privileges of the web server.

ID	Name	Product	Family	Type	Severity
16105	Debian DSA-627-1 : namazu2 - unsanitised input	Nessus	Debian Local Security Checks	Local	medium
2474	Namazu < 2.0.14 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	CGI		high
16045	Namazu < 2.0.14 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2004-1318

medium

Tenable Plugins

medium

high

high