CVE-2006-2533

Cross-site scripting (XSS) vulnerability in (1) addWeblog.php and (2) leaveComments.php in Destiney Rated Images Script 0.5.0 does not properly filter all vulnerable HTML tags, which allows remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/18070
http://secunia.com/advisories/20249
http://securityreason.com/securityalert/940
http://www.vupen.com/english/advisories/2006/1927
https://exchange.xforce.ibmcloud.com/vulnerabilities/26605
http://www.securityfocus.com/archive/1/435093/100/0/threaded
http://www.securityfocus.com/archive/1/434691/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:greg_donald:destiney_rated_images_script:0.5.0:*:*:*:*:*:*:*

Information

Published : 2006-05-22 16:10

Updated : 2018-10-18 09:40

NVD link : CVE-2006-2533

Mitre link : CVE-2006-2533

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

greg_donald

destiney_rated_images_script

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/18070", "name": "18070", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/20249", "name": "20249", "tags": [], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/940", "name": "940", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/1927", "name": "ADV-2006-1927", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26605", "name": "destineyris-multiple-xss(26605)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/435093/100/0/threaded", "name": "20060526 Re: Destiney Rated Images Script v0.5.0 - XSS Vulnv", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/434691/100/0/threaded", "name": "20060521 Destiney Rated Images Script v0.5.0 - XSS Vulnv", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in (1) addWeblog.php and (2) leaveComments.php in Destiney Rated Images Script 0.5.0 does not properly filter all vulnerable HTML tags, which allows remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-2533", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-05-22T23:10Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:greg_donald:destiney_rated_images_script:0.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:40Z"}