CVE-2006-6401

Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=116344068502988&w=2	Mailing List
http://secunia.com/advisories/22813	Vendor Advisory
http://securitytracker.com/id?1017210	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/30319	Broken Link
http://www.vupen.com/english/advisories/2006/4468	Not Applicable
http://marc.info/?l=bugtraq&m=116344068502988&w=2	Mailing List
http://secunia.com/advisories/22813	Vendor Advisory
http://securitytracker.com/id?1017210	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/30319	Broken Link
http://www.vupen.com/english/advisories/2006/4468	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:mystats:mystats:*:*:*:*:*:*:*:*

History

21 Nov 2024, 00:22

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=bugtraq&m=116344068502988&w=2 - Mailing List~~	() http://marc.info/?l=bugtraq&m=116344068502988&w=2 - Mailing List
References	~~() http://secunia.com/advisories/22813 - Vendor Advisory~~	() http://secunia.com/advisories/22813 - Vendor Advisory
References	~~() http://securitytracker.com/id?1017210 - Exploit, Third Party Advisory, VDB Entry~~	() http://securitytracker.com/id?1017210 - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.osvdb.org/30319 - Broken Link~~	() http://www.osvdb.org/30319 - Broken Link
References	~~() http://www.vupen.com/english/advisories/2006/4468 - Not Applicable~~	() http://www.vupen.com/english/advisories/2006/4468 - Not Applicable

Information

Published : 2006-12-10 02:28

Updated : 2024-11-21 00:22

NVD link : CVE-2006-6401

Mitre link : CVE-2006-6401

CVE.ORG link : CVE-2006-6401

JSON object : View

Products Affected

mystats

mystats

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2006-6401", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-12-10T02:28:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=116344068502988&w=2", "tags": ["Mailing List"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22813", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1017210", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/30319", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4468", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=116344068502988&w=2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/22813", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1017210", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/30319", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/4468", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en mystats.php de MyStats 1.0.8 y versiones anteriores permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante los par\u00e1metros 1) connexion, (2) by, y (3) details."}], "lastModified": "2024-11-21T00:22:35.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mystats:mystats:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80360CC1-BA7F-4B0E-A8B6-07245411FB15", "versionEndIncluding": "1.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}