CVE-2006-3958

Multiple unspecified cross-site scripting (XSS) vulnerabilities in Taskjitsu 2.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the Search Tasks system, or authenticated users via (2) the Edit Task system, (3) the back-end Category Editor system, and (4) "Pages that display task status, email addresses, URL, customer, and project information."

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.pkrinternet.com/download/RELEASE-NOTES.txt
http://secunia.com/advisories/21242	Patch Vendor Advisory
https://www.pkrinternet.com/taskjitsu/task/3477
http://www.securityfocus.com/bid/19251
http://www.osvdb.org/27637
http://www.vupen.com/english/advisories/2006/3058	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28178

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:pkr_internet:taskjitsu:2.0.3:*:*:*:*:*:*:*

Information

Published : 2006-08-01 14:04

Updated : 2017-07-19 18:32

NVD link : CVE-2006-3958

Mitre link : CVE-2006-3958

JSON object : View

CWE

NVD-CWE-noinfo

Advertisement

Products Affected

pkr_internet

taskjitsu

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.pkrinternet.com/download/RELEASE-NOTES.txt", "name": "http://www.pkrinternet.com/download/RELEASE-NOTES.txt", "tags": [], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/21242", "name": "21242", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://www.pkrinternet.com/taskjitsu/task/3477", "name": "https://www.pkrinternet.com/taskjitsu/task/3477", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/19251", "name": "19251", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/27637", "name": "27637", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2006/3058", "name": "ADV-2006-3058", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28178", "name": "taskjitsu-unspecified-xss(28178)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple unspecified cross-site scripting (XSS) vulnerabilities in Taskjitsu 2.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the Search Tasks system, or authenticated users via (2) the Edit Task system, (3) the back-end Category Editor system, and (4) \"Pages that display task status, email addresses, URL, customer, and project information.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3958", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-08-01T21:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:pkr_internet:taskjitsu:2.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:32Z"}