CVE-2005-2736

Cross-site scripting (XSS) vulnerability in YaPig 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://cedri.cc/advisories/EXIF_XSS.txt	Vendor Advisory
http://marc.info/?l=bugtraq&m=112511025414488&w=2
http://secunia.com/advisories/16596/
http://securitytracker.com/id?1014802
http://www.securityfocus.com/bid/14670
https://exchange.xforce.ibmcloud.com/vulnerabilities/22020

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:yapig:yapig:0.92b:::::::*
	cpe:2.3:a:yapig:yapig:0.93u:::::::*
	cpe:2.3:a:yapig:yapig:0.94u:::::::*
	cpe:2.3:a:yapig:yapig:0.95:::::::*
	cpe:2.3:a:yapig:yapig:0.95b:::::::*

History

No history.

Information

Published : 2005-08-30 11:45

Updated : 2024-02-28 10:42

NVD link : CVE-2005-2736

Mitre link : CVE-2005-2736

CVE.ORG link : CVE-2005-2736

JSON object : View

Products Affected

yapig

yapig

CWE

NVD-CWE-Other

{"id": "CVE-2005-2736", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-08-30T11:45:00.000", "references": [{"url": "http://cedri.cc/advisories/EXIF_XSS.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=112511025414488&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/16596/", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1014802", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/14670", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22020", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in YaPig 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag."}], "lastModified": "2017-07-11T01:32:58.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yapig:yapig:0.92b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1395410C-F729-4095-BC00-C15D61509A07"}, {"criteria": "cpe:2.3:a:yapig:yapig:0.93u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31FA4A81-65AD-4888-9F06-15C8E21D4907"}, {"criteria": "cpe:2.3:a:yapig:yapig:0.94u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2286772D-80C5-496F-8052-596AF41E7E98"}, {"criteria": "cpe:2.3:a:yapig:yapig:0.95:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "035E0872-E690-4827-9B7D-9BB1E0C5B49C"}, {"criteria": "cpe:2.3:a:yapig:yapig:0.95b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE8377F5-3C14-45FC-86F3-EB918687D2F1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}