Vulnerabilities > CVE-2006-4956 - Input Validation vulnerability in Neosys Neon Webmail 5.06/5.07

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
neosys
exploit available
NVD
Published: 2006-09-23
Updated: 2017-07-20

Summary

Cross-site scripting (XSS) vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the in_name parameter, as used by the Name field.

Vulnerable Configurations

Part Description Count
Application
Neosys
2

Exploit-Db

descriptionNeoSys Neon Webmail for Java 5.06/5.07 updateuser Servlet in_name Parameter XSS. CVE-2006-4956. Webapps exploit for jsp platform
idEDB-ID:28610
last seen2016-02-03
modified2006-09-20
published2006-09-20
reporterTan Chew Keong
sourcehttps://www.exploit-db.com/download/28610/
titleNeoSys Neon Webmail for Java 5.06/5.07 updateuser Servlet in_name Parameter XSS

References