{"id": "CVE-2005-4044", "bulletinFamily": "NVD", "title": "CVE-2005-4044", "description": "Cross-site scripting (XSS) vulnerability in search.cgi in Amazon Search Directory 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly the search parameter.", "published": "2005-12-06T11:03:00", "modified": "2017-07-20T01:29:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-4044", "reporter": "cve@mitre.org", "references": ["http://pridels0.blogspot.com/2005/12/amazon-search-directory-xss-vuln.html", "http://www.osvdb.org/21438", "http://secunia.com/advisories/17875", "http://www.vupen.com/english/advisories/2005/2735", "https://exchange.xforce.ibmcloud.com/vulnerabilities/23408"], "cvelist": ["CVE-2005-4044"], "type": "cve", "lastseen": "2019-05-29T18:08:15", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "345e838e19ddbd060a5221e2af2496c4"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "9efba0cc2279a36a2113e9150cd4c39d"}, {"key": "cvss", "hash": "f74a1c24e49a5ecb0eefb5e51d4caa14"}, {"key": "cvss2", "hash": "1376299678e4b22a45cbb6e661929c18"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "5f53f3eae1086e1e363cb82bd01ad04c"}, {"key": "href", "hash": "aa3978baf081028e33893f61ab4e57c2"}, {"key": "modified", "hash": "8beb21540db0e4c02532c0e597356857"}, {"key": "published", "hash": "adb5dac00d0cbea8545cb87c8e002207"}, {"key": "references", "hash": "a9656e588d6f74f5e7c1c73409e41cfe"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "619356cb162487b43db0a00c618e03b1"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "8af06df9d3a023934f69668c8bf1fc0b467441296c6647b49d40fdb34d302a04", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:21438"]}], "modified": "2019-05-29T18:08:15"}, "score": {"value": 4.6, "vector": "NONE", "modified": "2019-05-29T18:08:15"}, "vulnersScore": 4.6}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "mr._cgi_guy amazon_search_directory", "operator": "le", "version": "1.0.0"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:18", "bulletinFamily": "software", "description": "## Vulnerability Description\nAmazon Search Directory contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'search' variable upon submission to the 'search.cgi' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nAmazon Search Directory contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'search' variable upon submission to the 'search.cgi' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## References:\nVendor URL: http://www.mrcgiguy.com/amazondetails.shtml\n[Secunia Advisory ID:17875](https://secuniaresearch.flexerasoftware.com/advisories/17875/)\nOther Advisory URL: http://pridels.blogspot.com/2005/12/amazon-search-directory-xss-vuln.html\nISS X-Force ID: 23408\n[CVE-2005-4044](https://vulners.com/cve/CVE-2005-4044)\n", "modified": "2005-12-05T16:46:58", "published": "2005-12-05T16:46:58", "href": "https://vulners.com/osvdb/OSVDB:21438", "id": "OSVDB:21438", "title": "Amazon Search Directory search.cgi search Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}