CVE-2009-1729

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain.

• CWE-79

• http://osvdb.org/54609
• http://osvdb.org/54610
• http://seclists.org/fulldisclosure/2009/May/0177.html
• http://secunia.com/advisories/32474
• http://securitytracker.com/alerts/2009/May/1022266.html
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-122793-26-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-258068-1Patch, Vendor Advisory
• http://www.coresecurity.com/content/sun-communications-expressExploit
• http://www.securityfocus.com/archive/1/503675/100/0/threaded
• http://www.securityfocus.com/bid/34154Exploit, Patch
• http://www.securityfocus.com/bid/34155Exploit, Patch
• http://www.vupen.com/english/advisories/2009/1389
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50658
• http://osvdb.org/54609
• http://osvdb.org/54610
• http://seclists.org/fulldisclosure/2009/May/0177.html
• http://secunia.com/advisories/32474
• http://securitytracker.com/alerts/2009/May/1022266.html
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-122793-26-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-258068-1Patch, Vendor Advisory
• http://www.coresecurity.com/content/sun-communications-expressExploit
• http://www.securityfocus.com/archive/1/503675/100/0/threaded
• http://www.securityfocus.com/bid/34154Exploit, Patch
• http://www.securityfocus.com/bid/34155Exploit, Patch
• http://www.vupen.com/english/advisories/2009/1389
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50658

Published

May 21, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1723CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an inc…
• CVE-2009-1724Cross-site scripting (XSS) vulnerability in WebKit in Apple …
• CVE-2009-1725WebKit in Apple Safari before 4.0.2, as used on iPhone OS be…
• CVE-2009-1726Heap-based buffer overflow in ColorSync in Apple Mac OS X 10…
• CVE-2009-1727Incomplete blacklist vulnerability in CoreTypes in Apple Mac…
• CVE-2009-1728Stack-based buffer overflow in Image RAW in Apple Mac OS X 1…
• CVE-2009-1730Multiple directory traversal vulnerabilities in NetMechanica…
• CVE-2009-1731SQL injection vulnerability in panel/index.php in MLFFAT 2.1…
• CVE-2009-1732Cross-site scripting (XSS) vulnerability in admin/usermanage…
• CVE-2009-1733Cross-site request forgery (CSRF) vulnerability in IPplan 4.…
• CVE-2009-1734SQL injection vulnerability in listing_video.php in VidShare…
• CVE-2009-1735Cross-site scripting (XSS) vulnerability in search.php in Vi…