CVE-2006-6928

Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp, the (2) the Keyword parameter to (c) searchkey.asp, or the (3) refno parameter to (d) forminfo.asp.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/23049	Vendor Advisory
http://securityreason.com/securityalert/2143
http://www.securityfocus.com/archive/1/452112/100/0/threaded
http://www.securityfocus.com/bid/21191	Exploit Vendor Advisory
http://www.vupen.com/english/advisories/2006/4630
https://exchange.xforce.ibmcloud.com/vulnerabilities/30425

Configurations

Configuration 1 (hide)

cpe:2.3:a:grandora:rialto:1.6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-01-13 02:28

Updated : 2024-02-04 17:13

NVD link : CVE-2006-6928

Mitre link : CVE-2006-6928

CVE.ORG link : CVE-2006-6928

JSON object : View

Products Affected

grandora

rialto

CWE

NVD-CWE-Other

{"id": "CVE-2006-6928", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-01-13T02:28:00.000", "references": [{"url": "http://secunia.com/advisories/23049", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2143", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/452112/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21191", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4630", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30425", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp, the (2) the Keyword parameter to (c) searchkey.asp, or the (3) refno parameter to (d) forminfo.asp."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Rialto 1.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro (1) cat en (a) listmain.asp o (b) searchmain.asp, el par\u00e1metro (2) Keyword en (c) searchkey.asp, o el par\u00e1metro (3) refon en (d) forminfo.asp."}], "lastModified": "2018-10-16T16:29:06.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grandora:rialto:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EEA4251-E6C3-41E2-BC85-C10EE342F0AF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}