PT-2006-2740 · Xmb · Xmb Forum

Published 2006-04-12 · Updated 2021-04-29 · CVE-2006-1748

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: XMB Forum version 1.9.5

Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call. This causes the video to be rendered without disabling ActionScript, potentially leading to the execution of malicious code.

Recommendations: For XMB Forum version 1.9.5, consider disabling the upload of Flash (.SWF) videos or restricting the use of the getURL function call in uploaded videos to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1748

Affected Products

Xmb Forum

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1748 · Security Note
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1748 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25737 · Note
• http://securityfocus.com/bid/17445 · Note
• http://securityfocus.com/archive/1/430432/100/0/threaded · Note