Vulnerability-Lookup

CERTA-2006-AVI-144

Vulnerability from certfr_avis - Published: 2006-04-10 - Updated: 2006-04-13

None

Description

Une nouvelle version de phpBB a été publiée. Celle-ci corrige des vulnérabilités permettant de réaliser des dénis de service ou de réaliser des attaques de type Cross Site Scripting.

Solution

Mettre à jour phpBB en version 2.0.20.

phpBB versions 2.0.19 et antérieures.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Message d'annonce du 07 avril 2006 sur le site de phpBB	None	vendor-advisory
Site de phpBB :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cTT\u003ephpBB\u003c/TT\u003e versions 2.0.19 et ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nUne nouvelle version de phpBB a \u00e9t\u00e9 publi\u00e9e. Celle-ci corrige des\nvuln\u00e9rabilit\u00e9s permettant de r\u00e9aliser des d\u00e9nis de service ou de\nr\u00e9aliser des attaques de type Cross Site Scripting.\n\n## Solution\n\nMettre \u00e0 jour phpBB en version 2.0.20.\n",
  "cves": [
    {
      "name": "CVE-2006-0437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0437"
    },
    {
      "name": "CVE-2006-0063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0063"
    },
    {
      "name": "CVE-2006-0438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0438"
    }
  ],
  "initial_release_date": "2006-04-10T00:00:00",
  "last_revision_date": "2006-04-13T00:00:00",
  "links": [
    {
      "title": "Site de phpBB :",
      "url": "http://www.phpbb.com/"
    }
  ],
  "reference": "CERTA-2006-AVI-144",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-04-10T00:00:00.000000"
    },
    {
      "description": "mise \u00e0 jour de la section Risque, modification de la section Documentation et ajout des r\u00e9f\u00e9rences CVE.",
      "revision_date": "2006-04-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9s dans phpBB",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Message d\u0027annonce du 07 avril 2006 sur le site de phpBB",
      "url": "http://www.phpbb.com/phpBB/viewtopic.php?t=380687"
    }
  ]
}

CVE-2006-0437 (GCVE-0-2006-0437)

Vulnerability from cvelistv5 – Published: 2006-02-06 22:00 – Updated: 2024-08-07 16:34

Summary

Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.vupen.com/english/advisories/2006/0445	vdb-entryx_refsource_VUPEN
	http://secunia.com/advisories/18693	third-party-advisoryx_refsource_SECUNIA
	http://lists.grok.org.uk/pipermail/full-disclosur…	mailing-listx_refsource_FULLDISC
	http://securityreason.com/achievement_securityalert/31	third-party-advisoryx_refsource_SREASONRES
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://www.osvdb.org/22928	vdb-entryx_refsource_OSVDB
	http://securityreason.com/securityalert/406	third-party-advisoryx_refsource_SREASON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2006-0445",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0445"
          },
          {
            "name": "18693",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18693"
          },
          {
            "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
          },
          {
            "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASONRES",
              "x_transferred"
            ],
            "url": "http://securityreason.com/achievement_securityalert/31"
          },
          {
            "name": "phpbb-referer-header-http-xss(24497)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
          },
          {
            "name": "22928",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22928"
          },
          {
            "name": "406",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/406"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-02-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as \"onmouseover\" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for \"\u003c\" and \"\u003e\" characters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-19T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2006-0445",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0445"
        },
        {
          "name": "18693",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18693"
        },
        {
          "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
        },
        {
          "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASONRES"
          ],
          "url": "http://securityreason.com/achievement_securityalert/31"
        },
        {
          "name": "phpbb-referer-header-http-xss(24497)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
        },
        {
          "name": "22928",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22928"
        },
        {
          "name": "406",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/406"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0437",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as \"onmouseover\" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for \"\u003c\" and \"\u003e\" characters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2006-0445",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0445"
            },
            {
              "name": "18693",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18693"
            },
            {
              "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
            },
            {
              "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
              "refsource": "SREASONRES",
              "url": "http://securityreason.com/achievement_securityalert/31"
            },
            {
              "name": "phpbb-referer-header-http-xss(24497)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
            },
            {
              "name": "22928",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22928"
            },
            {
              "name": "406",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/406"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0437",
    "datePublished": "2006-02-06T22:00:00",
    "dateReserved": "2006-01-26T00:00:00",
    "dateUpdated": "2024-08-07T16:34:14.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0438 (GCVE-0-2006-0438)

Vulnerability from cvelistv5 – Published: 2006-02-06 22:00 – Updated: 2024-08-07 16:34

Summary

Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.osvdb.org/22929	vdb-entryx_refsource_OSVDB
	http://www.vupen.com/english/advisories/2006/0445	vdb-entryx_refsource_VUPEN
	http://secunia.com/advisories/18693	third-party-advisoryx_refsource_SECUNIA
	http://lists.grok.org.uk/pipermail/full-disclosur…	mailing-listx_refsource_FULLDISC
	http://securityreason.com/achievement_securityalert/31	third-party-advisoryx_refsource_SREASONRES
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://securityreason.com/securityalert/406	third-party-advisoryx_refsource_SREASON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.801Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "22929",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22929"
          },
          {
            "name": "ADV-2006-0445",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0445"
          },
          {
            "name": "18693",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18693"
          },
          {
            "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
          },
          {
            "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASONRES",
              "x_transferred"
            ],
            "url": "http://securityreason.com/achievement_securityalert/31"
          },
          {
            "name": "phpbb-referer-header-http-xss(24497)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
          },
          {
            "name": "406",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/406"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-02-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-19T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "22929",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22929"
        },
        {
          "name": "ADV-2006-0445",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0445"
        },
        {
          "name": "18693",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18693"
        },
        {
          "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
        },
        {
          "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASONRES"
          ],
          "url": "http://securityreason.com/achievement_securityalert/31"
        },
        {
          "name": "phpbb-referer-header-http-xss(24497)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
        },
        {
          "name": "406",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/406"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0438",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "22929",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22929"
            },
            {
              "name": "ADV-2006-0445",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0445"
            },
            {
              "name": "18693",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18693"
            },
            {
              "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html"
            },
            {
              "name": "20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin",
              "refsource": "SREASONRES",
              "url": "http://securityreason.com/achievement_securityalert/31"
            },
            {
              "name": "phpbb-referer-header-http-xss(24497)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24497"
            },
            {
              "name": "406",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/406"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0438",
    "datePublished": "2006-02-06T22:00:00",
    "dateReserved": "2006-01-26T00:00:00",
    "dateUpdated": "2024-08-07T16:34:14.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0063 (GCVE-0-2006-0063)

Vulnerability from cvelistv5 – Published: 2006-01-05 19:00 – Updated: 2024-08-07 16:18

Summary

Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.vupen.com/english/advisories/2006/0051	vdb-entryx_refsource_VUPEN
	http://www.osvdb.org/22672	vdb-entryx_refsource_OSVDB
	http://securityreason.com/securityalert/313	third-party-advisoryx_refsource_SREASON
	http://securityreason.com/achievement_securityalert/30	third-party-advisoryx_refsource_SREASONRES

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:18:20.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2006-0051",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0051"
          },
          {
            "name": "22672",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22672"
          },
          {
            "name": "313",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/313"
          },
          {
            "name": "20060105 phpBB 2.0.19 XSS",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASONRES",
              "x_transferred"
            ],
            "url": "http://securityreason.com/achievement_securityalert/30"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when \"Allowed HTML tags\" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with \u0027 (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-03T21:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2006-0051",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0051"
        },
        {
          "name": "22672",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22672"
        },
        {
          "name": "313",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/313"
        },
        {
          "name": "20060105 phpBB 2.0.19 XSS",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASONRES"
          ],
          "url": "http://securityreason.com/achievement_securityalert/30"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0063",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when \"Allowed HTML tags\" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with \u0027 (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2006-0051",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0051"
            },
            {
              "name": "22672",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22672"
            },
            {
              "name": "313",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/313"
            },
            {
              "name": "20060105 phpBB 2.0.19 XSS",
              "refsource": "SREASONRES",
              "url": "http://securityreason.com/achievement_securityalert/30"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0063",
    "datePublished": "2006-01-05T19:00:00",
    "dateReserved": "2006-01-03T00:00:00",
    "dateUpdated": "2024-08-07T16:18:20.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTA-2006-AVI-144

Description

Solution

CVE-2006-0437 (GCVE-0-2006-0437)

CVE-2006-0438 (GCVE-0-2006-0438)

CVE-2006-0063 (GCVE-0-2006-0063)

Tags

Sightings

Nomenclature