Lucene search

MitreCVE-2006-2809

HistoryJun 05, 2006 - 5:02 p.m.

CVE-2006-2809

2006-06-0517:02:00

mitre

web.nvd.nist.gov

cve

2006

2809

xss

vulnerabilities

ar-blog 5.2

index.php

remote attackers

web script

html

cve-2006-0333.

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

5.8

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in index.php in ar-blog 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) count parameter, and possibly the (2) next, (3) Year_the_news, and (4) mo parameters. NOTE: the year and month vectors are already covered by CVE-2006-0333.

Affected configurations

Nvd

Node

ar-blogar-blogMatch5.2

VendorProductVersionCPE
ar-blogar-blog5.2cpe:2.3:a:ar-blog:ar-blog:5.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ar-blog	ar-blog	5.2	cpe:2.3:a:ar-blog:ar-blog:5.2:::::::*

References

securityreason.com/securityalert/1035

www.securityfocus.com/archive/1/435205/100/0/threaded

exchange.xforce.ibmcloud.com/vulnerabilities/26787

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

5.8

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

Related for CVE-2006-2809