CVE-2006-3550
published 2006-07-13CVE-2006-3550: Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via…
PriorityP411low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
1.39%
69.1th percentile
Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | firepass_4100 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3jfq-8hwm-x9j5: Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5
ghsa_unreviewed·2022-05-01
CVE-2006-3550 [LOW] GHSA-3jfq-8hwm-x9j5: Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5
Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
GHSA
GHSA-cqvw-46pg-24r3: Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the x
ghsa_unreviewed·2022-05-01·CVSS 2.6
CVE-2007-0186 [LOW] GHSA-cqvw-46pg-24r3: Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the x
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.htmlhttp://securityreason.com/securityalert/1237http://securitytracker.com/id?1016431http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352http://www.securityfocus.com/archive/1/439033/100/0/threadedhttp://www.securityfocus.com/bid/18799http://www.vupen.com/english/advisories/2006/2678https://exchange.xforce.ibmcloud.com/vulnerabilities/27547http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.htmlhttp://securityreason.com/securityalert/1237http://securitytracker.com/id?1016431http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352http://www.securityfocus.com/archive/1/439033/100/0/threadedhttp://www.securityfocus.com/bid/18799http://www.vupen.com/english/advisories/2006/2678https://exchange.xforce.ibmcloud.com/vulnerabilities/27547
2006-07-13
Published