CVE-2004-1106

Опубликовано: 10 янв. 2005

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php.

Ссылки

http://g3cko.info/gallery2-4.patch
URL Repurposed
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=142&mode=thread&order=0&thold=0
http://www.debian.org/security/2005/dsa-642
Patch
http://www.gentoo.org/security/en/glsa/glsa-200411-10.xml
Patch
Vendor Advisory
http://www.securityfocus.com/bid/11602
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17948
http://g3cko.info/gallery2-4.patch
URL Repurposed
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=142&mode=thread&order=0&thold=0
http://www.debian.org/security/2005/dsa-642
Patch
http://www.gentoo.org/security/en/glsa/glsa-200411-10.xml
Patch
Vendor Advisory
http://www.securityfocus.com/bid/11602
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17948

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gallery_project:gallery:1.4:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4.3_pl1:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4.3_pl2:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4_pl1:*:*:*:*:*:*:*

cpe:2.3:a:gallery_project:gallery:1.4_pl2:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01631

Низкий

6.8 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2004-1106

debian

больше 20 лет назад

Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earl ...

GHSA-6mqx-3r5h-wq66

github

больше 3 лет назад