CVE

Id
14516  
CVE No.
CVE-2005-3310  
Status
Candidate  
Description
Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer, which renders malformed image types as HTML, enabling cross-site scripting (XSS) attacks. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in phpBB.  
Phase
Assigned (20051026)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
109676 14516 CVE-2005-3310 BUGTRAQ:20051022 phpBB 2.0.17 (and other BB systems as well) Cookie disclosure  View
109677 14516 CVE-2005-3310 URL:http://marc.info/?l=bugtraq&m=113017003617987&w=2  View
109678 14516 CVE-2005-3310 FULLDISC:20051022 phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.  View
109679 14516 CVE-2005-3310 URL:http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0479.html  View
109680 14516 CVE-2005-3310 DEBIAN:DSA-925  View
109681 14516 CVE-2005-3310 URL:http://www.debian.org/security/2005/dsa-925  View
109682 14516 CVE-2005-3310 BID:15170  View
109683 14516 CVE-2005-3310 URL:http://www.securityfocus.com/bid/15170  View
109684 14516 CVE-2005-3310 SECUNIA:17295  View
109685 14516 CVE-2005-3310 URL:http://secunia.com/advisories/17295/  View
109686 14516 CVE-2005-3310 SECUNIA:18098  View
109687 14516 CVE-2005-3310 URL:http://secunia.com/advisories/18098  View
109688 14516 CVE-2005-3310 XF:phpbb-avatar-bypass-security(22837)  View

Related JVN