CVE-2006-3519 - Multiple cross-site scripting (XSS) vulnerabilities in The Banner Engine (tbe) 4.0 allow remote atta

CVE-2006-3519

Summary

Multiple cross-site scripting (XSS) vulnerabilities in The Banner Engine (tbe) 4.0 allow remote attackers to execute arbitrary web script or HTML via the (1) text parameter in a search action to (a) top.php, and the (2) adminpass or (3) adminlogin parameter to (b) signup.php.

References

http://secunia.com/advisories/20916
http://securityreason.com/securityalert/1204
http://securitytracker.com/id?1016432
http://www.securityfocus.com/archive/1/438972/100/0/threaded
http://www.securityfocus.com/bid/18793
http://www.vupen.com/english/advisories/2006/2656
https://exchange.xforce.ibmcloud.com/vulnerabilities/27549

Vulnerable Configurations

cpe:2.3:a:native_solutions:the_banner_engine:4.0:*:*:*:*:*:*:*
cpe:2.3:a:native_solutions:the_banner_engine:4.0:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 18-10-2018 - 16:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	18793
bugtraq	20060703 TBE 4.0 XSS
sectrack	1016432
secunia	20916
sreason	1204
vupen	ADV-2006-2656
xf	tbe-signup-top-xss(27549)

Last major update

18-10-2018 - 16:47

Published

11-07-2006 - 23:05

Last modified

18-10-2018 - 16:47