CVE-2006-6919

Published: Jan 11, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing ">", which Sage modifies to close the img element before the malicious script.

Affected (1)

Products: Sage Mozdev: Sage

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sage Mozdev Sage	Up to 1.3.8

References (10)

http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2/

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/22809

Source: cve@mitre.org

PatchVendor Advisory

http://www.securityfocus.com/archive/1/452010/100/0/threaded

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/4426

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/30179

Source: cve@mitre.org

http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/22809

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/archive/1/452010/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2006/4426

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/30179

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.