CVE-2006-1946

Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/17598	Exploit
http://www.osvdb.org/24716	Exploit
http://www.osvdb.org/24717	Exploit
http://www.osvdb.org/24718	Exploit
http://secunia.com/advisories/19655	Exploit Vendor Advisory
http://pridels0.blogspot.com/2006/04/visale-xss-vuln.html
http://www.vupen.com/english/advisories/2006/1408
https://exchange.xforce.ibmcloud.com/vulnerabilities/25928

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:visale:visale:*:*:*:*:*:*:*:*

Information

Published : 2006-04-20 15:02

Updated : 2017-07-19 18:31

NVD link : CVE-2006-1946

Mitre link : CVE-2006-1946

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

visale

visale

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/17598", "name": "17598", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://www.osvdb.org/24716", "name": "24716", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/24717", "name": "24717", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/24718", "name": "24718", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://secunia.com/advisories/19655", "name": "19655", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://pridels0.blogspot.com/2006/04/visale-xss-vuln.html", "name": "http://pridels0.blogspot.com/2006/04/visale-xss-vuln.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2006/1408", "name": "ADV-2006-1408", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25928", "name": "visale-multiple-xss(25928)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-1946", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2006-04-20T22:02Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:visale:visale:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:31Z"}