Unscored severity · published Oct 24, 2006
CVE-2006-5486
Cross-site scripting (XSS) vulnerability in Webmail in Sun Java System Messaging Server 6.0 through 6.2 and iPlanet Messaging Server 5.2 allows remote attackers to execute…
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Webmail in Sun Java System Messaging Server 6.0 through 6.2 and iPlanet Messaging Server 5.2 allows remote attackers to execute arbitrary Javascript via crafted messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Iplanet Messaging Server · Sun
5.2 · source: NVD
JS
Java System Messaging Server · Sun
6.0; 6.1; 6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5486
Vendor Advisory
http://secunia.com/advisories/22575
securitytracker.com
http://securitytracker.com/id?1017113
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102497-1
www.securityfocus.com
http://www.securityfocus.com/bid/20708
www.vupen.com
http://www.vupen.com/english/advisories/2006/4183
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/29806
More from Iplanet Messaging Server
–
CVE-2004-2766
Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02 allows remote attackers to obtain unspecified "access" to e-mail via a crafted e-mail…
–
CVE-2004-2765
Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows…
–
CVE-2006-3159
pipe_master in Sun ONE/iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003) allows local users to read portions of restricted files via a symlink attack on msg.conf in a…
–
CVE-2005-2022
Unknown vulnerability in Webmail in iPlanet Messaging Server 5.2 Patch 1 and Sun ONE Messaging Server 6.2 allows remote attackers to execute arbitrary Javascript, possibly due to…