CVE-2005-2428

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Aug 3, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2005

CVE-2005-24295.0Firefox, when opening Microsoft Word documents, does not properly set the permissions on shared sections, which allows remote attackers to wCVE-2005-24304.3Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) CVE-2005-24315.0The (1) lost password and (2) account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail CVE-2005-24327.5SQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the id argument to admin pages such as (1) membeCVE-2005-24335.0PhpList allows remote attackers to obtain sensitive information via a direct request to (1) about.php, (2) connect.php, (3) domainstats.php CVE-2005-24345.0Linksys WRT54G router uses the same private key and certificate for every router, which allows remote attackers to sniff the SSL connection CVE-2005-24354.3Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows remote attackers to inject arbitrary web script or HTCVE-2005-24365.0browse.php in Website Baker Project allows remote attackers to obtain sensitive data via (1) a directory that does not exist in the dir paraCVE-2005-24375.0Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to upload and execute arCVE-2005-24384.3Cross-site scripting (XSS) vulnerability in UseBB 0.5.1 and earlier allows remote attackers to inject arbitrary Javascript via the BBCode coCVE-2005-24397.5SQL injection vulnerability in UseBB 0.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL CVE-2005-24407.5SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via
CVE-2005-2428: Medium severity, CVSS 5.0 | Vulnix