CVE-2005-4878

ACID 0.9.6b20 & BASE 1.2 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrary web script or HTML via the sig[1] parameter and possibly other parameters, a different vulnerability than CVE-2007-6156.

References (5)

[Issue Tracking] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=336788

[Vendor Advisory] http://secunia.com/advisories/17523

[Third Party Advisory, VDB Entry] http://www.osvdb.org/24306

[Third Party Advisory] http://www.debian.org/security/2005/dsa-893

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/48848

Scores

EPSS 0.0033

EPSS Percentile 55.5%

Classification

CWE

CWE-79

Status published

Affected Products (3)

acid/analysis_console_for_intrusion_databases

secureideas/basic_analysis_and_security_engine

n/a/n/a

Timeline

Published Feb 18, 2009

Tracked Since Feb 18, 2026