CVE-2010-2290

Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

• CWE-79

• http://ngenuity-is.com/advisories/2010/jun/9/mcafee-utm-firewall-help-cross-site-scripting/Exploit
• http://secunia.com/advisories/40089Vendor Advisory
• http://secunia.com/advisories/40138Vendor Advisory
• http://www.securityfocus.com/archive/1/511771/100/0/threaded
• http://www.securitytracker.com/id?1024091Exploit
• http://www.vupen.com/english/advisories/2010/1413Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10010Patch, Vendor Advisory
• http://ngenuity-is.com/advisories/2010/jun/9/mcafee-utm-firewall-help-cross-site-scripting/Exploit
• http://secunia.com/advisories/40089Vendor Advisory
• http://secunia.com/advisories/40138Vendor Advisory
• http://www.securityfocus.com/archive/1/511771/100/0/threaded
• http://www.securitytracker.com/id?1024091Exploit
• http://www.vupen.com/english/advisories/2010/1413Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10010Patch, Vendor Advisory

Published

Jun 15, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2284Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10…
• CVE-2010-2285The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 an…
• CVE-2010-2286The SigComp Universal Decompressor Virtual Machine dissector…
• CVE-2010-2287Buffer overflow in the SigComp Universal Decompressor Virtua…
• CVE-2010-2288Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cg…
• CVE-2010-2289Open redirect vulnerability in dana/home/homepage.cgi in Jun…
• CVE-2010-2291Unspecified vulnerability in the web interface in snom VoIP …
• CVE-2010-2292Cross-site scripting (XSS) vulnerability in the Ping tools w…
• CVE-2010-2293The Ping tools web interface in Dlink Di-604 router allows r…
• CVE-2010-2294Cross-site request forgery (CSRF) vulnerability in Plume CMS…
• CVE-2010-2295page/EventHandler.cpp in WebCore in WebKit in Google Chrome …
• CVE-2010-2296The implementation of unspecified DOM methods in Google Chro…