Lucene search

[email protected]CVE-2006-6375

HistoryDec 07, 2006 - 5:28 p.m.

CVE-2006-6375

2006-12-0717:28:00

[email protected]

web.nvd.nist.gov

cve-2006-6375

cross-site scripting

xss

smf

simple machines forum

remote attackers

web script

html

internet explorer

automatic type detection

5.9 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.034 Low

EPSS

Percentile

91.4%

JSON

Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer’s automatic type detection.

Affected configurations

NVD

Node

simple_machinessmfMatch1.0.9

simple_machinessmfMatch1.0_beta5p

simple_machinessmfMatch1.1_final

simple_machinessmfMatch1.1_rc3

CPENameOperatorVersion
simple_machines:smfsimple machines smfeq1.0.9
simple_machines:smfsimple machines smfeq1.0_beta5p
simple_machines:smfsimple machines smfeq1.1_final
simple_machines:smfsimple machines smfeq1.1_rc3

CPE	Name	Operator	Version
simple_machines:smf	simple machines smf	eq	1.0.9
simple_machines:smf	simple machines smf	eq	1.0_beta5p
simple_machines:smf	simple machines smf	eq	1.1_final
simple_machines:smf	simple machines smf	eq	1.1_rc3

References

secunia.com/advisories/23175

securityreason.com/securityalert/2001

www.securityfocus.com/archive/1/453426/100/0/threaded

www.securityfocus.com/bid/21431

www.vupen.com/english/advisories/2006/4843

exchange.xforce.ibmcloud.com/vulnerabilities/30659

5.9 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.034 Low

EPSS

Percentile

91.4%

JSON

Related for CVE-2006-6375

nvd1 cvelist1