QwikSec

Security Database

CVE

CWE

Training

CVE-2006-4712

Published: Sep 12, 2006

Modified: Aug 7, 2024

PUBLISHED

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_BID

20060908 Cross Context Scripting with Sage

mailing-list

x_refsource_BUGTRAQ

http://www.snellspace.com/wp/?p=410

x_refsource_MISC

http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml

x_refsource_MISC

vdb-entry

x_refsource_VUPEN

http://www.intertwingly.net/blog/2006/08/09/Attack-Delivery-TestSuite

x_refsource_MISC

sage-rss-xss(28855)

vdb-entry

x_refsource_XF

http://www.gnucitizen.org/blog/cross-context-scripting-with-sage

x_refsource_MISC

http://www.snellspace.com/wp/?p=448

x_refsource_MISC

third-party-advisory

x_refsource_SREASON

third-party-advisory

x_refsource_SECUNIA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.