« Volver al listado

CVE-2006-6990

Estado: ModificadaAlta (7.8)—

Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Advanced Search Technologies Inc. — Enigma Browser

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6990",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-09T01:28:00.000",
  "references": [
    {
      "url": "http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cruzado de dominios en Enigma Browser 3.8.8 permite a atacantes remotos acceder a información restringida desde otros dominios mediante una etiqueta de objeto, con un parámetro de datos que referencia un enlace en el sitio de origen de ataque, que especifica una cabecera Location HTTP la cual referencia el sitio destino, de esta manera hace aquel contenido disponible a través del atributo outerHTML en el objeto, vulnerabilidad similar a CVE-2006-3280."
    }
  ],
  "lastModified": "2026-06-16T22:34:10.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:advanced_search_technologies_inc.:enigma_browser:3.8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36E5C0EB-BC2B-481D-A4DB-C3096699569A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}