CVE-2005-3428

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to inject arbitrary web script or HTML via a message body.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.htmlExploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=113053680631151&w=2
http://secunia.com/advisories/17240/Patch, Vendor Advisory
http://securitytracker.com/id?1015117
http://www.osvdb.org/20488
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdfExploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22907
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1052
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.htmlExploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=113053680631151&w=2
http://secunia.com/advisories/17240/Patch, Vendor Advisory
http://securitytracker.com/id?1015117
http://www.osvdb.org/20488
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdfExploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22907
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1052

Timeline

Published: Nov 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-34294.3Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, w CVE-2005-34307.5Incomplete blacklist vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to upload and execute arbitrary scrip CVE-2005-34315.0Absolute path traversal vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to read arbitrary files via a full CVE-2005-34325.0MiniGal 2 (MG2) 0.5.1 allows remote attackers to list password protected images via a request to index.php with the list parameter set to * CVE-2005-34335.1Buffer overflow in Mirabilis ICQ 2003a allows user-assisted attackers to execute arbitrary code by convincing a user to enter long strings i CVE-2005-34347.5Archilles Newsworld before 1.5.0-rc1 stores (1) account.nwd and (2) session.nwd under the web root with insufficient access control, which a CVE-2005-34359.8admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user,CVE-2005-34364.3Cross-site scripting (XSS) vulnerability in Nuked-Klan 1.7 allows remote attackers to inject arbitrary web script or HTML via the (1) Search CVE-2005-343710.0Unspecified vulnerability in the PL/SQL component in Oracle Database Server 9i up to 10.1.0.4 has unknown impact and attack vectors, aka Ora CVE-2005-343810.0Multiple unspecified vulnerabilities in Oracle Database Server 9i up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln# CVE-2005-343910.0Multiple unspecified vulnerabilities in Oracle Database Server 10g up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln#CVE-2005-344010.0Unspecified vulnerability in Database Scheduler in Oracle Database Server 10g up to 10.1.0.3 has unknown impact and attack vectors, aka Orac