Vulnerability Description
Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to ProfileSettings page; (2) note parameter to PersonalNotes Section; (3) closed_msg, description, allowed_types parameters to WebsiteConfigurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Clip-Bucket | Clipbucket | <= 2.8.1 |
Related Weaknesses (CWE)
References
- https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/Third Party Advisory
- https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/Third Party Advisory
FAQ
What is CVE-2016-1000307?
CVE-2016-1000307 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occup...
How severe is CVE-2016-1000307?
CVE-2016-1000307 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1000307?
Check the references section above for vendor advisories and patch information. Affected products include: Clip-Bucket Clipbucket.