CVE-2006-2351
published 2006-05-15CVE-2006-2351: Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.55%
90.4th percentile
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ipswitch | whatsup_professional | — | — |
| ipswitch | whatsup_professional | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Ipswitch WhatsUp Professional 2006 - '/NmConsole/Navigation.asp?sDeviceView' Cross-Site Scripting
exploitdb·2006-05-12
CVE-2006-2351 Ipswitch WhatsUp Professional 2006 - '/NmConsole/Navigation.asp?sDeviceView' Cross-Site Scripting
Ipswitch WhatsUp Professional 2006 - '/NmConsole/Navigation.asp?sDeviceView' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/17964/info
WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code disclosure, cross-site scripting, and input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Successful exploits of these vulnerabilities could allow an attacker to access or modify data, steal cookie-based authentication credentials, perform username-enumeration, access sensitive information, and gain unauthorized access to script source code. Other attacks are also possible.
http://www.example.com:8022/NmCons
Exploit-DB
Ipswitch WhatsUp Professional 2006 - '/NmConsole/ToolResults.asp?sHostname' Cross-Site Scripting
exploitdb·2006-05-12
CVE-2006-2351 Ipswitch WhatsUp Professional 2006 - '/NmConsole/ToolResults.asp?sHostname' Cross-Site Scripting
Ipswitch WhatsUp Professional 2006 - '/NmConsole/ToolResults.asp?sHostname' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/17964/info
WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code disclosure, cross-site scripting, and input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Successful exploits of these vulnerabilities could allow an attacker to access or modify data, steal cookie-based authentication credentials, perform username-enumeration, access sensitive information, and gain unauthorized access to script source code. Other attacks are also possible.
http://www.example.com:8022/NmConso
No writeups or analysis indexed.
http://secunia.com/advisories/20075http://securityreason.com/securityalert/897http://www.osvdb.org/25469http://www.osvdb.org/25470http://www.securityfocus.com/archive/1/433808http://www.securityfocus.com/bid/17964http://www.vupen.com/english/advisories/2006/1787https://exchange.xforce.ibmcloud.com/vulnerabilities/26500http://secunia.com/advisories/20075http://securityreason.com/securityalert/897http://www.osvdb.org/25469http://www.osvdb.org/25470http://www.securityfocus.com/archive/1/433808http://www.securityfocus.com/bid/17964http://www.vupen.com/english/advisories/2006/1787https://exchange.xforce.ibmcloud.com/vulnerabilities/26500
2006-05-15
Published