PT-2006-6805 · Tdiary · Tdiary

福森 大喜 · Published 2006-11-30 · Updated 2011-03-08 · CVE-2006-6174

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions tDiary versions prior to 2.0.3 tDiary versions 2.1.x prior to 2.1.4.20061126

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the conf parameter in (1) tdiary.rb and (2) skel/conf.rhtml. This could potentially lead to unauthorized actions on the affected web application.

Recommendations For tDiary versions prior to 2.0.3, update to version 2.0.3 or later. For tDiary versions 2.1.x prior to 2.1.4.20061126, update to version 2.1.4.20061126 or later.

Fix

Related Identifiers

CVE-2006-6174

Affected Products

Tdiary

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2006-6174 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6174 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-6174 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-6174 · Vendor Advisory
• http://secunia.com/advisories/23092 · Vendor Advisory
• http://sourceforge.net/forum/forum.php?forum_id=638868 · Patch
• http://tdiary.org/20061126.html · Note
• http://jvn.jp/jp/JVN%2347223461/index.html · Note
• http://osvdb.org/30701 · Note
• http://osvdb.org/31993 · Note
• http://tdiary.org/download/tdiary.20061126.patch · Note
• http://vupen.com/english/advisories/2006/4722 · Note
• http://securityfocus.com/bid/21321 · Note