PT-2006-3864 · I.List · I.List

Publicado 2006-06-12 · Atualizado 2008-09-05 · CVE-2006-2957

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions i.List versions 1.5 beta and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the banurl parameter to "add.php" API endpoint. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For i.List versions 1.5 beta and earlier, avoid using the banurl parameter in the "add.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "add.php" endpoint to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2957

Produtos afetados

I.List

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-2957 · Nota de Segurança
• http://secunia.com/advisories/20547 · Aviso do Fabricante