16340Third-party advisory
http://secunia.com/advisories/16340 CVE-2006-0663
IBM Lotus Domino 6.x/7.0 - iNotes JavaScript: Filter Bypass
Record summary
CVE-2006-0663 has a selected CVSS score of 4.3; EIP currently links 2 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java script:"; or (3) when the Domino Web Access ActiveX control is not installed, via an email attachment filename.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBIBM Lotus Domino 6.x/7.0 - iNotes JavaScript: Filter BypassExploitDB exploitby Jakob BalleNot analyzed1 file
ExploitDBIBM Lotus Domino 6.x/7.0 iNotes - Email Subject Cross-Site ScriptingExploitDB exploitby Jakob BalleNot analyzed1 file
References
Showing 12 of 13secunia.com
http://secunia.com/secunia_research/2005-38/advisory 1015610vdb entry
http://securitytracker.com/id?1015610 www-1.ibm.comConfirmation
http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919 23077vdb entry
http://www.osvdb.org/23077 23078vdb entry
http://www.osvdb.org/23078 23079vdb entry
http://www.osvdb.org/23079 16577vdb entry
http://www.securityfocus.com/bid/16577 ADV-2006-0499vdb entry
http://www.vupen.com/english/advisories/2006/0499 domino-webaccess-attachment-xss(24611)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/24611 domino-webaccess-javascript-xss(24613)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/24613 domino-webaccess-filename-xss(24614)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/24614