Search
Find a vulnerability
Search criteria
6 vulnerabilities by oasyssoft
CVE-2006-2349 (GCVE-0-2006-2349)
Vulnerability from nvd – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:51
VLAI
EPSS
VEX
Summary
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
10 references
| URL | Tags |
|---|---|
| http://marc.info/?l=bugtraq&m=115047779610633&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://lists.oasyssoft.com/ebd-devel/200605/msg00… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
| http://securitytracker.com/id?1016326 | vdb-entryx_refsource_SECTRACK |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:03.486Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016326"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016326"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2349",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"refsource": "MLIST",
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016326"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2349",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:51:03.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2348 (GCVE-0-2006-2348)
Vulnerability from nvd – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2348",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2348",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2347 (GCVE-0-2006-2347)
Vulnerability from nvd – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via \"\u0027\" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2347",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via \"\u0027\" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2347",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2349 (GCVE-0-2006-2349)
Vulnerability from cvelistv5 – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:51
VLAI
EPSS
VEX
Summary
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
10 references
| URL | Tags |
|---|---|
| http://marc.info/?l=bugtraq&m=115047779610633&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://lists.oasyssoft.com/ebd-devel/200605/msg00… | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
| http://securitytracker.com/id?1016326 | vdb-entryx_refsource_SECTRACK |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:03.486Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016326"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016326"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2349",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html. NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060616 Re: Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=115047779610633\u0026w=2"
},
{
"name": "[ebd-devel] 20060502 actualizaci\u00f3n de seguridad",
"refsource": "MLIST",
"url": "http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html"
},
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "ebd-multiple-auth-bypass(26474)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26474"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "1016326",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016326"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2349",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:51:03.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2348 (GCVE-0-2006-2348)
Vulnerability from cvelistv5 – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2348",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
},
{
"name": "ebd-formgrupo-xss(26475)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26475"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2348",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2347 (GCVE-0-2006-2347)
Vulnerability from cvelistv5 – Published: 2006-05-12 17:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20071 | third-party-advisoryx_refsource_SECUNIA |
| http://securityreason.com/securityalert/891 | third-party-advisoryx_refsource_SREASON |
| http://lists.grok.org.uk/pipermail/full-disclosur… | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/archive/1/433807/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/17933 | vdb-entryx_refsource_BID |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.vupen.com/english/advisories/2006/1784 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via \"\u0027\" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2347",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via \"\u0027\" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20071"
},
{
"name": "891",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/891"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html"
},
{
"name": "20060511 Several flaws in e-business designer (eBD)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433807/100/0/threaded"
},
{
"name": "17933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17933"
},
{
"name": "ebd-multiple-path-disclosure(26476)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26476"
},
{
"name": "ADV-2006-1784",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1784"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2347",
"datePublished": "2006-05-12T17:00:00.000Z",
"dateReserved": "2006-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}