id: PYSEC-2005-1
details: Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall
  Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript
  in the SRC attribute of an IMG tag.
affected:
- package:
    name: trac
    ecosystem: PyPI
    purl: pkg:pypi/trac
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "0.10"
  versions:
  - 0.8.4
  - "0.9"
references:
- type: WEB
  url: http://projects.edgewall.com/trac/ticket/2473
- type: WEB
  url: http://www.securityfocus.com/bid/16198
- type: ADVISORY
  url: http://secunia.com/advisories/18465
- type: ADVISORY
  url: http://www.debian.org/security/2006/dsa-951
- type: ADVISORY
  url: http://secunia.com/advisories/18555
- type: WEB
  url: http://trac.edgewall.org/ticket/2473
- type: ADVISORY
  url: http://www.vupen.com/english/advisories/2006/0226
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/24183
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6vhp-hp77-6w52
aliases:
- CVE-2005-4644
- GHSA-6vhp-hp77-6w52
modified: "2021-07-16T01:31:33.917972Z"
published: "2005-12-31T05:00:00Z"