PT-2006-3738 · Hotwebscripts.Com · Weblog Oggi

Luny · Published 2006-06-05 · Updated 2018-10-18 · CVE-2006-2820

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions HotWebScripts.com Weblog Oggi version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML, possibly by using a javascript URI in the SRC attribute of an IMG element, via a comment.

Recommendations For version 1.0, consider disabling the comment feature until a patch is available to prevent exploitation of this issue. Restrict access to the SRC attribute of an IMG element to minimize the risk of arbitrary script injection.

Fix

Related Identifiers

CVE-2006-2820

Affected Products

Weblog Oggi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-2820 · Security Note
• http://securityreason.com/securityalert/1028 · Note
• http://securityfocus.com/archive/1/435713/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26928 · Note
• http://securityfocus.com/bid/18240 · Note
• http://secunia.com/advisories/20447 · Note