PT-2006-3499 · Jemscripts · Jemscripts Downloadcontrol

Steven M. Christey · Published 2006-05-24 · Updated 2018-10-18 · CVE-2006-2553

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jemscripts DownloadControl version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to "dc.php".

Recommendations For Jemscripts DownloadControl version 1.0, avoid using the dcid parameter in the "dc.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "dc.php" endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-2553

Affected Products

Jemscripts Downloadcontrol

References · 8

• http://secunia.com/advisories/20212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2553 · Security Note
• http://securityfocus.com/archive/1/434533/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1928 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26624 · Note
• http://securityreason.com/securityalert/943 · Note
• http://attrition.org/pipermail/vim/2006-May/000783.html · Note
• http://osvdb.org/25715 · Note