PT-2005-3720 · Unclassified · Unclassified Newsboard

Retrogod · Published 2005-09-08 · Updated 2017-07-11 · CVE-2005-2855

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Unclassified NewsBoard version 1.5.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via the description field, potentially leading to cross-site scripting (XSS) attacks. XSS is a type of attack where an attacker injects malicious scripts into a website, which are then executed by the user's browser.

Recommendations For Unclassified NewsBoard version 1.5.3, consider validating and sanitizing user input in the description field to prevent the injection of malicious scripts. As a temporary workaround, restrict access to the description field until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2855

Affected Products

Unclassified Newsboard

References · 9

• 🔥 https://exploit-db.com/exploits/26224 · Exploit
• 🔥 http://securityfocus.com/bid/14748 · Exploit
• 🔥 http://packetstormsecurity.org/0509-exploits/unb153.html · Exploit
• http://secunia.com/advisories/16726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2855 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22172 · Note
• http://osvdb.org/19239 · Note
• http://marc.info/?l=bugtraq&m=112605049014473&w=2 · Note
• http://vupen.com/english/advisories/2005/1665 · Note