| ID |
CVE-2006-6779
|
| Summary |
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript. Successful exploitation requires the ability to upload SWF files, which is disabled by default, and must be enabled by site administrators. |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:jelsoft:vbulletin:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.5.1:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.5.2:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.5.4:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.5.4:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.6.0:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.6.1:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.6.2:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.6.2:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.6.3:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.6.3:*:*:*:*:*:*:*
-
cpe:2.3:a:jelsoft:vbulletin:3.6.4:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.6.4:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 6.8 (as of 17-10-2018 - 21:49) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
| refmap
via4
|
| bid | 21736 | | bugtraq | - 20061224 XSS with Vbulletin (new idea !)
- 20061227 Re: XSS with Vbulletin (new idea !)
- 20061228 Re: XSS with Vbulletin (new idea !)
| | sreason | 2084 | | xf | vbulletin-actionscript-xss(31119) |
|
| Last major update |
17-10-2018 - 21:49 |
| Published |
28-12-2006 - 00:28 |
| Last modified |
17-10-2018 - 21:49 |
