CVE-2006-6153

Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://s-a-p.ca/index.php?page=OurAdvisories&id=47	URL Repurposed
http://secunia.com/advisories/22987	Vendor Advisory
http://securityreason.com/securityalert/1926
http://securitytracker.com/id?1017259
http://www.securityfocus.com/archive/1/452179/100/100/threaded
http://www.securityfocus.com/bid/21190	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/30446

Configurations

Configuration 1 (hide)

cpe:2.3:a:vspin.net:classified_system:2004:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-11-28 23:28

Updated : 2024-02-14 01:17

NVD link : CVE-2006-6153

Mitre link : CVE-2006-6153

CVE.ORG link : CVE-2006-6153

JSON object : View

Products Affected

vspin.net

classified_system

CWE

NVD-CWE-Other

{"id": "CVE-2006-6153", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-11-28T23:28:00.000", "references": [{"url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=47", "tags": ["URL Repurposed"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22987", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1926", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1017259", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/452179/100/100/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21190", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30446", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en vSpin.net Classified System 2004 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el (1) par\u00e1metro catname a cat.asp o el (2) par\u00e1metro minprice a search.asp."}], "lastModified": "2024-02-14T01:17:43.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vspin.net:classified_system:2004:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCFD0151-8EF1-437B-B718-4801544F5768"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}