PT-2006-3738 · Hotwebscripts.Com · Weblog Oggi

Luny · Publicado 2006-06-05 · Atualizado 2018-10-18 · CVE-2006-2820

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions HotWebScripts.com Weblog Oggi version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML, possibly by using a javascript URI in the SRC attribute of an IMG element, via a comment.

Recommendations For version 1.0, consider disabling the comment feature until a patch is available to prevent exploitation of this issue. Restrict access to the SRC attribute of an IMG element to minimize the risk of arbitrary script injection.

Correção

Identificadores relacionados

CVE-2006-2820

Produtos afetados

Weblog Oggi

Referências · 6

• http://securityreason.com/securityalert/1028 · Nota
• http://securityfocus.com/archive/1/435713/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26928 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2820 · Nota de Segurança
• http://securityfocus.com/bid/18240 · Nota
• http://secunia.com/advisories/20447 · Nota