CVE

Id
13634  
CVE No.
CVE-2005-2428  
Status
Candidate  
Description
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.  
Phase
Assigned (20050803)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
98870 13634 CVE-2005-2428 BUGTRAQ:20050726 CYBSEC - Security Advisory: Default Configuration Information  View
98871 13634 CVE-2005-2428 URL:http://marc.info/?l=bugtraq&m=112240869130356&w=2  View
98872 13634 CVE-2005-2428 MISC:http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf  View
98873 13634 CVE-2005-2428 CONFIRM:http://www-1.ibm.com/support/docview.wss?uid=swg21212934  View
98874 13634 CVE-2005-2428 MISC:http://www.securiteam.com/securitynews/5FP0E15GLQ.html  View
98875 13634 CVE-2005-2428 BID:14389  View
98876 13634 CVE-2005-2428 URL:http://www.securityfocus.com/bid/14389  View
98877 13634 CVE-2005-2428 OSVDB:18462  View
98878 13634 CVE-2005-2428 URL:http://www.osvdb.org/18462  View
98879 13634 CVE-2005-2428 SECTRACK:1014584  View
98880 13634 CVE-2005-2428 URL:http://securitytracker.com/id?1014584  View
98881 13634 CVE-2005-2428 SECUNIA:16231  View
98882 13634 CVE-2005-2428 URL:http://secunia.com/advisories/16231/  View
98883 13634 CVE-2005-2428 XF:lotus-domino-names-obtain-information(21556)  View

Related JVN