Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field. NOTE: the vendor has disputed this vulnerability, saying that "it does not exist currently in the Bluepay 2.0 product," and older versions might not have been affected either. As of 20060512, CVE has not formally investigated this dispute
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bluepay | Bluepay Manager | <= 2.0 |
References
- http://pridels0.blogspot.com/2006/04/bluepay-manager-v20-script-insertion.html
- http://pridels0.blogspot.com/2006/04/bluepay-manager-v20-script-insertion.html
FAQ
What is CVE-2006-1854?
CVE-2006-1854 is a vulnerability with a CVSS score of 2.6 (LOW). Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and ...
How severe is CVE-2006-1854?
CVE-2006-1854 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-1854?
Check the references section above for vendor advisories and patch information. Affected products include: Bluepay Bluepay Manager.