CVE:CVE-2010-2957
CNNVD:CNNVD-201009-096
Serendipity 1.5.4之前的版本中存在跨站脚本攻击漏洞。当"Remember me"登陆启用时，远程攻击者可以借助未明向量注入任意web脚本或者HTML。
solution:Upgrade s9y serendipity to a higher version than 1.5.3,0.3,0.4,0.5,0.5:pl1,0.6,0.6:pl1,0.6:pl2,0.6:pl3,0.6:rc1,0.6:rc2,0.7,0.7:beta1,0.7:beta2,0.7:beta3,0.7:beta4,0.7:rc1,0.7.1,0.8,0.8:beta5,0.8:beta6,0.8:beta6_snapshot,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.9,0.9.1,1.0,1.0:beta1,1.0:beta2,1.0:beta3,1.0.1,1.0.2,1.0.3,1.0.4,1.1,1.1:beta1,1.1.1,1.1.2,1.1.3,1.1.4,1.2,1.2:beta5,1.2.1,1.3,1.3.1,1.4,1.4.1,1.5,1.5:beta1,1.5.1,1.5.2,and avoid the version (,1.5.3],0.3,0.4,0.5,0.5:pl1,0.6,0.6:pl1,0.6:pl2,0.6:pl3,0.6:rc1,0.6:rc2,0.7,0.7:beta1,0.7:beta2,0.7:beta3,0.7:beta4,0.7:rc1,0.7.1,0.8,0.8:beta5,0.8:beta6,0.8:beta6_snapshot,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.9,0.9.1,1.0,1.0:beta1,1.0:beta2,1.0:beta3,1.0.1,1.0.2,1.0.3,1.0.4,1.1,1.1:beta1,1.1.1,1.1.2,1.1.3,1.1.4,1.2,1.2:beta5,1.2.1,1.3,1.3.1,1.4,1.4.1,1.5,1.5:beta1,1.5.1,1.5.2