CVE-2006-6919
- State
- Published
- Severity
- Not scored
- Published
- Jan 11, 2007
- Updated
- Aug 7, 2024
- Reserved
- Jan 11, 2007
Description
Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing ">", which Sage modifies to close the img element before the malicious script.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20061118 Sage cross-context scripting -> LOCAL-CONTEXT SCRIPTINGmailing-list
- http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2/
- ADV-2006-4426vdb-entry
- sage-img-xss(30179)vdb-entry
- 22809third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.