PT-2006-6805 · Tdiary · Tdiary

福森 大喜 · Publicado 2006-11-30 · Atualizado 2011-03-08 · CVE-2006-6174

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions tDiary versions prior to 2.0.3 tDiary versions 2.1.x prior to 2.1.4.20061126

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the conf parameter in (1) tdiary.rb and (2) skel/conf.rhtml. This could potentially lead to unauthorized actions on the affected web application.

Recommendations For tDiary versions prior to 2.0.3, update to version 2.0.3 or later. For tDiary versions 2.1.x prior to 2.1.4.20061126, update to version 2.1.4.20061126 or later.

Correção

Identificadores relacionados

CVE-2006-6174

Produtos afetados

Tdiary

Referências · 13

• https://nvd.nist.gov/vuln/detail/CVE-2006-6174 · Nota de Segurança
• http://tdiary.org/20061126.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6174 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-6174 · Aviso do Fabricante
• http://jvn.jp/jp/JVN%2347223461/index.html · Nota
• http://osvdb.org/30701 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-6174 · Aviso do Fabricante
• http://secunia.com/advisories/23092 · Aviso do Fabricante
• http://osvdb.org/31993 · Nota
• http://tdiary.org/download/tdiary.20061126.patch · Nota
• http://vupen.com/english/advisories/2006/4722 · Nota
• http://securityfocus.com/bid/21321 · Nota
• http://sourceforge.net/forum/forum.php?forum_id=638868 · Correção