Lucene search
HistorySep 23, 2006 - 10:07 a.m.
CVE-2006-4956
cve
2006
4956
cross-site scripting
xss
vulnerability
neon webmail
java
updateuser servlet
web script
html
remote attackers
6.3 Medium
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.007 Low
EPSS
Percentile
79.2%
Cross-site scripting (XSS) vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the in_name parameter, as used by the Name field.
| CPE | Name | Operator | Version |
|---|---|---|---|
| neosys:neon_webmail | neosys neon webmail | eq | 5.06 |
| neosys:neon_webmail | neosys neon webmail | eq | 5.07 |
6.3 Medium
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.007 Low
EPSS
Percentile
79.2%