CVE-2005-2860

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112561344400914&w=2
http://seclists.org/lists/vulnwatch/2005/Jul-Sep/0032.htmlExploit, Patch, Vendor Advisory
http://www.cybsec.com/vuln/010905-multiple_webscanner_script_injection.pdfExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/14717
http://marc.info/?l=bugtraq&m=112561344400914&w=2
http://seclists.org/lists/vulnwatch/2005/Jul-Sep/0032.htmlExploit, Patch, Vendor Advisory
http://www.cybsec.com/vuln/010905-multiple_webscanner_script_injection.pdfExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/14717

Timeline

Published: Sep 8, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-28614.3Cross-site scripting (XSS) vulnerability in N-Stealth Commercial Edition before 5.8.0.38 and Free Edition before 5.8.1.03 allows remote atta CVE-2005-28627.5ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a b CVE-2005-28634.3Cross-site scripting (XSS) vulnerability in openwebmail-main.pl in OpenWebMail 2.41 allows remote attackers to inject arbitrary web script o CVE-2005-28642.1URBAN 1.5.3_1 allows local users to overwrite arbitrary files via a symlink attack on the (1) high score or (2) save game files.CVE-2005-28657.5Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the config[CVE-2005-28664.6Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to CVE-2005-28677.5SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.CVE-2005-28682.1ZipTorrent 1.3.7.3 stores sensitive information in plaintext in the pref.txt file, which allows local users to obtain sensitive information CVE-2005-28694.3Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML CVE-2005-28707.5Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via c CVE-2005-28717.5Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows re CVE-2005-28725.0The ipt_recent kernel module (ipt_recent.c) in Linux kernel before 2.6.12, when running on 64-bit processors such as AMD64, allows remote at