CVE

Id
19470  
CVE No.
CVE-2006-3366  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in V3 Chat allow remote attackers to inject arbitrary web script or HTML via crafted HTML tags, as demonstrated by the IMG tag, in the (1) id parameter in (a) mail/index.php and (b) mail/reply.php; (2) login_id parameter in (c) members/is_online.php; (3) site_id parameter in (d) messenger/online.php, (e) messenger/search.php, and (f) messenger/profile.php; (4) contact_name parameter in messenger/search.php; (5) membername parameter in (g) messenger/profileview.php; (6) unspecified parameters used when "editing a profile"; and (7) cust_name parameter in (h) messenger/expire.php. NOTE: The vendor disputes the vectors involving files in the messenger directory, stating "... the referenced folder "messenger" was never available to the general public...".  
Phase
Assigned (20060706)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
174879 19470 CVE-2006-3366 BUGTRAQ:20060617 V3Chat Instant Messenger - XSS  View
174880 19470 CVE-2006-3366 URL:http://www.securityfocus.com/archive/1/archive/1/437755/100/200/threaded  View
174881 19470 CVE-2006-3366 BUGTRAQ:20060622 Re: V3Chat Instant Messenger - XSS  View
174882 19470 CVE-2006-3366 URL:http://www.securityfocus.com/archive/1/archive/1/438069/100/200/threaded  View
174883 19470 CVE-2006-3366 BID:18543  View
174884 19470 CVE-2006-3366 URL:http://www.securityfocus.com/bid/18543  View
174885 19470 CVE-2006-3366 VUPEN:ADV-2006-2474  View
174886 19470 CVE-2006-3366 URL:http://www.vupen.com/english/advisories/2006/2474  View
174887 19470 CVE-2006-3366 SECTRACK:1016340  View

Related JVN