NVD

Id
49268  
Name
CVE-2009-2006  
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) search_term parameter to main/auth/courses.php; the (2) frm_title and (3) frm_content parameters in a new personal agenda item action; the (4) title and (5) tutor_name parameters in a new course action; and the (6) student and (7) course parameters to main/mySpace/myStudents.php. NOTE: vectors 2 and 3 might only be exploitable via a separate CSRF vulnerability.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-06-08  
Modified Date
2009-06-09  
Seq
2009-2006  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
249502 49268 CVE-2009-2006 http://holisticinfosec.org/content/view/112/45/  View
249503 49268 CVE-2009-2006 http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8  View
249504 49268 CVE-2009-2006 34928  View
249505 49268 CVE-2009-2006 ADV-2009-1300  View
249506 49268 CVE-2009-2006 dokeos-agenda-item-xss(50498)  View
249507 49268 CVE-2009-2006 dokeos-new-course-xss(50500)  View
249508 49268 CVE-2009-2006 dokeos-mystudents-xss(50502)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42482 JVNDB-2009-003489 Dokeos におけるクロスサイトスクリプティングの脆弱性 Dokeos には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2009-2006 39437 CVE-2009-2006 49268 2.6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003489.html 2009-06-08 2012-06-26 View