PT-2006-2652 · Unknown · Chucky A. Ivey N.T.

Aliaksandr Hartsuyeu · Publicado 2006-04-07 · Atualizado 2018-10-18 · CVE-2006-1657

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Chucky A. Ivey N.T. version 1.1.0

Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the username parameter when the administrator views the "Login Log" page. This occurs because the username parameter is not properly filtered.

Recommendations: For Chucky A. Ivey N.T. version 1.1.0, consider filtering or sanitizing the username parameter to prevent injection of malicious scripts or HTML when viewing the "Login Log" page. As a temporary workaround, restrict access to the "Login Log" page until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2006-1657

Produtos afetados

Chucky A. Ivey N.T.

Referências · 9

• http://vupen.com/english/advisories/2006/1243 · Nota
• http://securityfocus.com/bid/17387 · Nota
• http://osvdb.org/24397 · Nota
• http://securityfocus.com/archive/1/431344/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25638 · Nota
• http://evuln.com/vulns/121/summary.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1657 · Nota de Segurança
• http://secunia.com/advisories/19526 · Aviso do Fabricante
• http://securityreason.com/securityalert/741 · Nota