Unscored severity · published Jun 7, 2006
CVE-2006-2900
Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the…
–
CVSS
12.6%
EPSS
No
On KEV
Description
Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
IE · Microsoft
5.01; 6; 6; 6; 6; 6; +4 more · source: NVD
NC
Network Camera Server Vb101 · Canon
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2900
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
Vendor Advisory
http://secunia.com/advisories/20449
securityreason.com
http://securityreason.com/securityalert/1059
www.securityfocus.com
http://www.securityfocus.com/bid/18308
Vendor Advisory
http://www.vupen.com/english/advisories/2006/2161
More from Network Camera Server Vb101
–
CVE-2007-2680
Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB150 with firmware 1.1…
–
CVE-2006-7065
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in…
–
CVE-2006-3354
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object to certain values…
–
CVE-2006-1192
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that…
–
CVE-2006-1188
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption