PT-2006-5363 · Microsoft · Internet Explorer

Published 2006-12-31 · Updated 2017-07-20 · CVE-2006-4576

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Address Book version 1.04e

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML by uploading an HTML file with a GIF or JPG extension. This uploaded file can be rendered by Internet Explorer, potentially leading to the execution of malicious scripts.

Recommendations For version 1.04e, consider restricting the upload of files with GIF or JPG extensions to prevent the injection of malicious HTML code until a patch is available. As a temporary workaround, avoid using Internet Explorer to render uploaded files.

Exploit

Fix

Related Identifiers

CVE-2006-4576

Affected Products

Internet Explorer

References · 6

• 🔥 http://secunia.com/secunia_research/2006-76/advisory · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4576 · Security Note
• http://osvdb.org/32567 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31239 · Note
• http://securityfocus.com/bid/21870 · Note
• http://secunia.com/advisories/21694 · Note