github - ghsa-f53c-gmxc-3ww8

ghsa-f53c-gmxc-3ww8

Vulnerability from github

Published

2022-05-01 07:19

Modified

2022-05-01 07:19

Details

Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-4560"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-09-06T00:04:00Z",
    "severity": "HIGH"
  },
  "details": "Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser\u0027s session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker\u0027s control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running.",
  "id": "GHSA-f53c-gmxc-3ww8",
  "modified": "2022-05-01T07:19:49Z",
  "published": "2022-05-01T07:19:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4560"
    },
    {
      "type": "WEB",
      "url": "http://polyboy.net/xss/dnsslurp.html"
    },
    {
      "type": "WEB",
      "url": "http://shampoo.antville.org/stories/1451301"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/31329"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2006-4560

Vulnerability from cvelistv5

Published

2006-09-06 00:00

Modified

2024-08-07 19:14

Severity ?

Summary

References

▼	URL	Tags
	http://www.securityfocus.com/archive/1/443209/100/200/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.osvdb.org/31329	vdb-entry, x_refsource_OSVDB
	http://shampoo.antville.org/stories/1451301/	x_refsource_MISC
	http://polyboy.net/xss/dnsslurp.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:14:47.371Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060814 (somewhat) breaking the same-origin policy by undermining dns-pinning",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded"
          },
          {
            "name": "31329",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/31329"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://shampoo.antville.org/stories/1451301/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://polyboy.net/xss/dnsslurp.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-08-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser\u0027s session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker\u0027s control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060814 (somewhat) breaking the same-origin policy by undermining dns-pinning",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded"
        },
        {
          "name": "31329",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/31329"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://shampoo.antville.org/stories/1451301/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://polyboy.net/xss/dnsslurp.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4560",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser\u0027s session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker\u0027s control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060814 (somewhat) breaking the same-origin policy by undermining dns-pinning",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded"
            },
            {
              "name": "31329",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/31329"
            },
            {
              "name": "http://shampoo.antville.org/stories/1451301/",
              "refsource": "MISC",
              "url": "http://shampoo.antville.org/stories/1451301/"
            },
            {
              "name": "http://polyboy.net/xss/dnsslurp.html",
              "refsource": "MISC",
              "url": "http://polyboy.net/xss/dnsslurp.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-4560",
    "datePublished": "2006-09-06T00:00:00",
    "dateReserved": "2006-09-05T00:00:00",
    "dateUpdated": "2024-08-07T19:14:47.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted