{"id":"CVE-2016-1926","details":"Cross-site scripting (XSS) vulnerability in the charts module in Greenbone Security Assistant (GSA) 6.x before 6.0.8 allows remote attackers to inject arbitrary web script or HTML via the aggregate_type parameter in a get_aggregate command to omp.","modified":"2026-07-08T05:47:57.224397620Z","published":"2016-01-26T19:59:09.500Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"22"},{"last_affected":"22"},{"introduced":"23"},{"last_affected":"23"}]},{"vendor_product":"greenbone:greenbone_os","cpes":["cpe:2.3:o:greenbone:greenbone_os:3.1.10:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.11:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.12:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.13:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.14:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.15:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.16:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.17:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.18:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.19:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.1:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.20:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.21:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.22:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.23:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.6:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.7:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.8:*:*:*:*:*:*:*","cpe:2.3:o:greenbone:greenbone_os:3.1.9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.1.1"},{"last_affected":"3.1.1"},{"introduced":"3.1.6"},{"last_affected":"3.1.6"},{"introduced":"3.1.7"},{"last_affected":"3.1.7"},{"introduced":"3.1.8"},{"last_affected":"3.1.8"},{"introduced":"3.1.9"},{"last_affected":"3.1.9"},{"introduced":"3.1.10"},{"last_affected":"3.1.10"},{"introduced":"3.1.11"},{"last_affected":"3.1.11"},{"introduced":"3.1.12"},{"last_affected":"3.1.12"},{"introduced":"3.1.13"},{"last_affected":"3.1.13"},{"introduced":"3.1.14"},{"last_affected":"3.1.14"},{"introduced":"3.1.15"},{"last_affected":"3.1.15"},{"introduced":"3.1.16"},{"last_affected":"3.1.16"},{"introduced":"3.1.17"},{"last_affected":"3.1.17"},{"introduced":"3.1.18"},{"last_affected":"3.1.18"},{"introduced":"3.1.19"},{"last_affected":"3.1.19"},{"introduced":"3.1.20"},{"last_affected":"3.1.20"},{"introduced":"3.1.21"},{"last_affected":"3.1.21"},{"introduced":"3.1.22"},{"last_affected":"3.1.22"},{"introduced":"3.1.23"},{"last_affected":"3.1.23"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/archive/1/537335/100/0/threaded"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183371.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184478.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/135328/OpenVAS-Greenbone-Security-Assistant-Cross-Site-Scripting.html"},{"type":"ADVISORY","url":"http://www.greenbone.net/technology/gbsa2016-01.html"},{"type":"ADVISORY","url":"http://www.openvas.org/OVSA20160113.html"},{"type":"EVIDENCE","url":"https://en.internetwache.org/cve-2016-1926-xss-in-the-greenbone-security-assistant-20-01-2016/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/greenbone/gsa","events":[{"introduced":"a7a43630c67d21e1ffb30607d8d51c4dc84b6fae"},{"last_affected":"7a129252056973da7218cc9115a238d39cc0accd"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.1:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.3:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.4:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:greenbone:greenbone_security_assistant:6.0.7:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.0"},{"last_affected":"6.0.0"},{"introduced":"6.0.1"},{"last_affected":"6.0.1"},{"introduced":"6.0.2"},{"last_affected":"6.0.2"},{"introduced":"6.0.3"},{"last_affected":"6.0.3"},{"introduced":"6.0.4"},{"last_affected":"6.0.4"},{"introduced":"6.0.5"},{"last_affected":"6.0.5"},{"introduced":"6.0.6"},{"last_affected":"6.0.6"},{"introduced":"6.0.7"},{"last_affected":"6.0.7"}]}}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1926.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}