PT-2006-2652 · Unknown · Chucky A. Ivey N.T.

Aliaksandr Hartsuyeu · Published 2006-04-07 · Updated 2018-10-18 · CVE-2006-1657

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Chucky A. Ivey N.T. version 1.1.0

Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the username parameter when the administrator views the "Login Log" page. This occurs because the username parameter is not properly filtered.

Recommendations: For Chucky A. Ivey N.T. version 1.1.0, consider filtering or sanitizing the username parameter to prevent injection of malicious scripts or HTML when viewing the "Login Log" page. As a temporary workaround, restrict access to the "Login Log" page until a proper fix is applied.

Fix

Related Identifiers

CVE-2006-1657

Affected Products

Chucky A. Ivey N.T.

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-1657 · Security Note
• http://secunia.com/advisories/19526 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1243 · Note
• http://securityfocus.com/bid/17387 · Note
• http://osvdb.org/24397 · Note
• http://securityfocus.com/archive/1/431344/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25638 · Note
• http://evuln.com/vulns/121/summary.html · Note
• http://securityreason.com/securityalert/741 · Note