PT-2006-5363 · Microsoft · Internet Explorer

Publicado 2006-12-31 · Atualizado 2017-07-20 · CVE-2006-4576

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Address Book version 1.04e

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML by uploading an HTML file with a GIF or JPG extension. This uploaded file can be rendered by Internet Explorer, potentially leading to the execution of malicious scripts.

Recommendations For version 1.04e, consider restricting the upload of files with GIF or JPG extensions to prevent the injection of malicious HTML code until a patch is available. As a temporary workaround, avoid using Internet Explorer to render uploaded files.

Exploit

Correção

Identificadores relacionados

CVE-2006-4576

Produtos afetados

Internet Explorer

Referências · 6

• 🔥 http://secunia.com/secunia_research/2006-76/advisory · Exploit
• http://osvdb.org/32567 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4576 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31239 · Nota
• http://securityfocus.com/bid/21870 · Nota
• http://secunia.com/advisories/21694 · Nota