CVE-2007-6659

{"id": "CVE-2007-6659", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-01-04T11:46:00.000", "references": [{"url": "http://2z-project.ru/forum/viewtopic.php?pid=8309", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28244", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3514", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/485590/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/27057", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://2z-project.ru/forum/viewtopic.php?pid=8309", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/28244", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/3514", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/485590/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/27057", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en 2z project 0.9.6.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) contentshort o (2) contentfull en una acci\u00f3n addnews del URI por defecto;(3) el par\u00e1metro content en una acci\u00f3n pm write de 2z/admin.php; (4) el par\u00e1metro referer de templates/default/usermenu.tpl, accedido a trav\u00e9s de index.php; o los par\u00e1metros (5) newavatar o (6) newphoto en una acci\u00f3n profile del URI por defecto bajo 2z/."}], "lastModified": "2024-11-21T00:40:42.380", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:2z_project:2z_project:0.9.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1E80A0B-04AB-4391-94C8-1D389BCE5606"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}