CVE-2006-4712 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2006-4712
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-4712

Description: Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/28855 SREASON http://securityreason.com/securityalert/1558 SAID Secunia Advisory: SA21839 MISC http://www.gnucitizen.org/blog/cross-context-scripting-with-sage http://www.snellspace.com/wp/?p=448 http://www.snellspace.com/wp/?p=410 http://www.intertwingly.net/blog/2006/08/09/Attack-Delivery-TestSuite http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/445648/100/0/threaded BID 19928

Return to the previous page.