4.3

CVE-2006-0032

Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 2000 Updatesp1
Microsoft ≫ Windows 2000 Updatesp2
Microsoft ≫ Windows 2000 Updatesp3
Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Windows 2000 Versionresource_kit
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition Updatesp1
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition Updatesp1_beta_1
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition_itanium
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition_itanium Updatesp1
Microsoft ≫ Windows 2003 Server Versiondatacenter_edition_itanium Updatesp1_beta_1
Microsoft ≫ Windows 2003 Server Versionenterprise_64-bit
Microsoft ≫ Windows 2003 Server Versionenterprise_edition Updatesp1
Microsoft ≫ Windows 2003 Server Versionenterprise_edition Updatesp1_beta_1
Microsoft ≫ Windows 2003 Server Versionenterprise_edition_itanium
Microsoft ≫ Windows 2003 Server Versionenterprise_edition_itanium Updatesp1
Microsoft ≫ Windows 2003 Server Versionenterprise_edition_itanium Updatesp1_beta_1
Microsoft ≫ Windows 2003 Server Versionr2 Editiondatacenter_64-bit
Microsoft ≫ Windows 2003 Server Versionsp1 Editionenterprise
Microsoft ≫ Windows 2003 Server Versionstandard
Microsoft ≫ Windows 2003 Server Versionstandard Updatesp1
Microsoft ≫ Windows 2003 Server Versionstandard Updatesp1_beta_1
Microsoft ≫ Windows 2003 Server Versionstandard_64-bit
Microsoft ≫ Windows 2003 Server Versionweb Updatesp1
Microsoft ≫ Windows 2003 Server Versionweb Updatesp1_beta_1
Microsoft ≫ Windows Xp Edition64-bit
Microsoft ≫ Windows Xp Editionhome
Microsoft ≫ Windows Xp Editionmedia_center
Microsoft ≫ Windows Xp Updategold Editionprofessional
Microsoft ≫ Windows Xp Updatesp1 Editionhome
Microsoft ≫ Windows Xp Updatesp1 Editionmedia_center
Microsoft ≫ Windows Xp Updatesp2 Editionhome
Microsoft ≫ Windows Xp Updatesp2 Editionmedia_center
Microsoft ≫ Windows Xp Updatesp2 Editiontablet_pc
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 76.87% 0.989
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.