CVE-2006-1407

Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/17263
http://secunia.com/advisories/19375	Vendor Advisory
http://attrition.org/pipermail/vim/2006-March/000654.html
http://www.osvdb.org/24125
http://www.osvdb.org/24126
http://pridels0.blogspot.com/2006/03/helm-web-hosting-control-panel-xss.html
http://www.vupen.com/english/advisories/2006/1093
https://exchange.xforce.ibmcloud.com/vulnerabilities/30309
https://exchange.xforce.ibmcloud.com/vulnerabilities/25470

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:webhost_automation:helm_web_hosting_control_panel:*:*:*:*:*:*:*:*

Information

Published : 2006-03-28 03:06

Updated : 2017-07-19 18:30

NVD link : CVE-2006-1407

Mitre link : CVE-2006-1407

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

webhost_automation

helm_web_hosting_control_panel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/17263", "name": "17263", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/19375", "name": "19375", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://attrition.org/pipermail/vim/2006-March/000654.html", "name": "20060327 Helm Control Panel followup", "tags": [], "refsource": "VIM"}, {"url": "http://www.osvdb.org/24125", "name": "24125", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/24126", "name": "24126", "tags": [], "refsource": "OSVDB"}, {"url": "http://pridels0.blogspot.com/2006/03/helm-web-hosting-control-panel-xss.html", "name": "http://pridels0.blogspot.com/2006/03/helm-web-hosting-control-panel-xss.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2006/1093", "name": "ADV-2006-1093", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30309", "name": "helm-domainsusersdefaault-xss(30309)", "tags": [], "refsource": "XF"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25470", "name": "helm-domainsdefault-xss(25470)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-1407", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-03-28T11:06Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:webhost_automation:helm_web_hosting_control_panel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.2.10"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:30Z"}