Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2006-6142 | First vendor Publication | 2006-12-05 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6142 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:9988 | |||
| Oval ID: | oval:org.mitre.oval:def:9988 | ||
| Title: | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." | ||
| Description: | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-6142 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-02-27 | Name : Fedora Update for squirrelmail FEDORA-2007-088 File : nvt/gb_fedora_2007_088_squirrelmail_fc5.nasl |
| 2009-02-27 | Name : Fedora Update for squirrelmail FEDORA-2007-089 File : nvt/gb_fedora_2007_089_squirrelmail_fc6.nasl |
| 2009-02-27 | Name : Fedora Update for squirrelmail FEDORA-2007-505 File : nvt/gb_fedora_2007_505_squirrelmail_fc6.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1241-1 (squirrelmail) File : nvt/deb_1241_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 31722 | SquirrelMail magicHTML Filter Unspecified Issue |
| 31721 | SquirrelMail compose.php Multiple Parameter XSS |
| 31720 | SquirrelMail webmail.php mailto Parameter XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0022.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_squirrelmail-2409.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_squirrelmail-2417.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-007.nasl - Type : ACT_GATHER_INFO |
| 2007-05-16 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-505.nasl - Type : ACT_GATHER_INFO |
| 2007-02-09 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0022.nasl - Type : ACT_GATHER_INFO |
| 2007-02-09 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0022.nasl - Type : ACT_GATHER_INFO |
| 2007-01-18 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-088.nasl - Type : ACT_GATHER_INFO |
| 2007-01-18 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-089.nasl - Type : ACT_GATHER_INFO |
| 2006-12-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1241.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:18:51 |
|
| 2024-11-28 12:10:39 |
|
| 2021-05-04 12:04:54 |
|
| 2021-04-22 01:05:31 |
|
| 2020-05-23 00:18:45 |
|
| 2017-10-11 09:23:47 |
|
| 2017-07-29 12:01:47 |
|
| 2016-04-26 15:21:06 |
|
| 2014-02-17 10:37:58 |
|
| 2013-05-11 11:15:23 |
|
