PT-2006-7251 · Lxl · Hyperv

Aria · Publicado 2006-12-20 · Atualizado 2018-10-17 · CVE-2006-6649

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HyperVM versions 1.2 and earlier

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via an encoded frm action parameter in the display.php file. The vendor has disputed this issue, but the nature of the dispute is unclear.

Recommendations For HyperVM versions 1.2 and earlier, as a temporary workaround, consider restricting access to the display.php file until a resolution is determined, and avoid using the encoded frm action parameter in this file. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-6649

Produtos afetados

Hyperv

Referências · 7

• 🔥 http://aria-security.com/forum/showthread.php?p=89#post89 · Exploit
• http://securityfocus.com/archive/1/454704/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/5062 · Nota
• http://secunia.com/advisories/23413 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6649 · Nota de Segurança
• http://attrition.org/pipermail/vim/2006-December/001191.html · Correção
• http://securityreason.com/securityalert/2051 · Nota