CVE-2006-6987

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 9, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2006

CVE-2006-69887.8Cross-domain vulnerability in Slim Browser 4.07 build 100 allows remote attackers to access restricted information from other domains via anCVE-2006-69897.8Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains vCVE-2006-69907.8Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an objectCVE-2006-69917.8Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an objectCVE-2006-69927.8Cross-domain vulnerability in GoSuRF Browser 2.62 allows remote attackers to access restricted information from other domains via an object CVE-2006-69937.5Multiple SQL injection vulnerabilities in pages/addcomment2.php in Neuron Blog 1.1 allow remote attackers to inject arbitrary SQL commands vCVE-2006-69946.4Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execuCVE-2006-69956.0mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter.CVE-2006-69964.3Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via CVE-2006-699710.0Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and EnterCVE-2006-69985.0install/loader_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY_STRCVE-2006-69994.3attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified
CVE-2006-6987: High severity, CVSS 7.8 | Vulnix