Lucene search

[email protected]CVE-2006-3253

HistoryJun 28, 2006 - 1:45 a.m.

CVE-2006-3253

2006-06-2801:45:00

[email protected]

web.nvd.nist.gov

cve

2006

3253

cross-site scripting

xss

vbulletin

member.php

web script

html

remote attackers

vendor dispute

filtering system

nvd

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

6.1 Medium

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.9%

JSON

Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.

Affected configurations

NVD

Node

jelsoftvbulletinMatch3.5.0

jelsoftvbulletinMatch3.5.0_beta_1

jelsoftvbulletinMatch3.5.0_beta_2

jelsoftvbulletinMatch3.5.0_beta_3

jelsoftvbulletinMatch3.5.0_beta_4

jelsoftvbulletinMatch3.5.0_rc1

jelsoftvbulletinMatch3.5.0_rc2

jelsoftvbulletinMatch3.5.0_rc3

jelsoftvbulletinMatch3.5.1

jelsoftvbulletinMatch3.5.2

jelsoftvbulletinMatch3.5.3

CPENameOperatorVersion
jelsoft:vbulletinjelsoft vbulletineq3.5.0
jelsoft:vbulletinjelsoft vbulletineq3.5.0_beta_1
jelsoft:vbulletinjelsoft vbulletineq3.5.0_beta_2
jelsoft:vbulletinjelsoft vbulletineq3.5.0_beta_3
jelsoft:vbulletinjelsoft vbulletineq3.5.0_beta_4
jelsoft:vbulletinjelsoft vbulletineq3.5.0_rc1
jelsoft:vbulletinjelsoft vbulletineq3.5.0_rc2
jelsoft:vbulletinjelsoft vbulletineq3.5.0_rc3
jelsoft:vbulletinjelsoft vbulletineq3.5.1
jelsoft:vbulletinjelsoft vbulletineq3.5.2

CPE	Name	Operator	Version
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_beta_1
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_beta_2
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_beta_3
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_beta_4
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_rc1
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_rc2
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.0_rc3
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.1
jelsoft:vbulletin	jelsoft vbulletin	eq	3.5.2

Rows per page:

1-10 of 111

References

securityreason.com/securityalert/1155

securitytracker.com/id?1016348

www.osvdb.org/27508

www.securityfocus.com/archive/1/437817/100/0/threaded

www.securityfocus.com/archive/1/438364/100/100/threaded

www.securityfocus.com/bid/18551

exchange.xforce.ibmcloud.com/vulnerabilities/27261

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

6.1 Medium

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.9%

JSON

Related for CVE-2006-3253

cvelist1 nvd1