PT-2006-2740 · Xmb · Xmb Forum

Publicado 2006-04-12 · Atualizado 2021-04-29 · CVE-2006-1748

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: XMB Forum version 1.9.5

Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call. This causes the video to be rendered without disabling ActionScript, potentially leading to the execution of malicious code.

Recommendations: For XMB Forum version 1.9.5, consider disabling the upload of Flash (.SWF) videos or restricting the use of the getURL function call in uploaded videos to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1748

Produtos afetados

Xmb Forum

Referências · 6

• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1748 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1748 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25737 · Nota
• http://securityfocus.com/bid/17445 · Nota
• http://securityfocus.com/archive/1/430432/100/0/threaded · Nota