Lucene search

[email protected]CVE-2006-4964

HistorySep 23, 2006 - 10:07 a.m.

CVE-2006-4964

2006-09-2310:07:00

[email protected]

web.nvd.nist.gov

cve-2006-4964

cross-site scripting

xss vulnerability

maxdev mdpro

anticracker

web security

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

5.5 Medium

AI Score

Confidence

High

0.081 Low

EPSS

Percentile

94.4%

JSON

Cross-site scripting (XSS) vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via (1) vectors that bypass the XSS protection mechanisms of the pnVarCleanFromInput function, and (2) unspecified vectors related to the AntiCracker.

Affected configurations

NVD

Node

maxdevmd-proRange≤1.0.76

maxdevmd-proMatch1.0.72

maxdevmd-proMatch1.0.73

maxdevmd-proMatch1.0.75

CPENameOperatorVersion
maxdev:md-promaxdev md-prole1.0.76
maxdev:md-promaxdev md-proeq1.0.72
maxdev:md-promaxdev md-proeq1.0.73
maxdev:md-promaxdev md-proeq1.0.75

CPE	Name	Operator	Version
maxdev:md-pro	maxdev md-pro	le	1.0.76
maxdev:md-pro	maxdev md-pro	eq	1.0.72
maxdev:md-pro	maxdev md-pro	eq	1.0.73
maxdev:md-pro	maxdev md-pro	eq	1.0.75

References

jvn.jp/jp/JVN%2346630603/index.html

secunia.com/advisories/22050

www.maxdev.com/Article605.phtml

www.maxdev.com/Downloads-index-req-dldet-lid-497-ttitle-Security_fix_for_MDPro_1.076.phtml

www.securityfocus.com/bid/20133

www.vupen.com/english/advisories/2006/3732

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

5.5 Medium

AI Score

Confidence

High

0.081 Low

EPSS

Percentile

94.4%

JSON

Related for CVE-2006-4964

nvd1 cvelist1