DATABASE RESOURCES PRICING ABOUT US

{"id": "PACKETSTORM:39702", "vendorId": null, "type": "packetstorm", "bulletinFamily": "exploit", "title": "SqWebMail.txt", "description": "", "published": "2005-08-31T00:00:00", "modified": "2005-08-31T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "cvss2": {}, "cvss3": {}, "href": "https://packetstormsecurity.com/files/39702/SqWebMail.txt.html", "reporter": "Jakob Balle", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2016-11-03T10:26:41", "viewCount": 10, "enchantments": {"score": {"value": -0.2, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.2}, "_state": {"dependencies": 1678912101, "score": 1678911848, "epss": 1678921929}, "_internal": {"score_hash": "2db941a383c63409378afa060680f23c"}, "sourceHref": "https://packetstormsecurity.com/files/download/39702/SqWebMail.txt", "sourceData": "`====================================================================== \n \nSecunia Research 29/08/2005 \n \n- SqWebMail HTML Emails Script Insertion Vulnerability - \n \n====================================================================== \nTable of Contents \n \nAffected Software....................................................1 \nSeverity.............................................................2 \nDescription of Vulnerability.........................................3 \nSolution.............................................................4 \nTime Table...........................................................5 \nCredits..............................................................6 \nReferences...........................................................7 \nAbout Secunia........................................................8 \nVerification.........................................................9 \n \n====================================================================== \n1) Affected Software \n \nSqWebMail 5.0.4 \n \nOther versions may also be affected. \n \n====================================================================== \n2) Severity \n \nRating: Moderately Critical \nImpact: Script Insertion \nWhere: From Remote \n \n====================================================================== \n3) Description of Vulnerability \n \nSecunia Research has discovered a vulnerability in SqWebMail, which \ncan be exploited by malicious people to conduct script insertion \nattacks. \n \nThe vulnerability is caused due to SqWebMail failing to properly \nsanitise HTML emails. This can be exploited to include arbitrary \nscript code in HTML emails, which will be executed in context of the \nSqWebMail server, as soon as the user views a received email. \n \nExample: \n<img src=\"cid:>\" onError=\"alert(document.domain);\"> \n \nSuccessful exploitation allows execution of arbitrary script code \nand makes it possible for a malicious person to perform the same \nactions as the user of the webmail account (e.g. sending or viewing \nemails). \n \n====================================================================== \n4) Solution \n \nThe vendor has issued an updated version of SqWebMail, which fixes \nthis vulnerability. \n \nhttp://www.courier-mta.org/?download.php \n \n====================================================================== \n5) Time Table \n \n26/08/2005 - Initial vendor notification. \n26/08/2005 - Vendor confirms vulnerability and releases a fix. \n29/08/2005 - Public disclosure. \n \n====================================================================== \n6) Credits \n \nDiscovered by Jakob Balle, Secunia Research. \n \n====================================================================== \n7) References \n \nNo references available. \n \n====================================================================== \n8) About Secunia \n \nSecunia collects, validates, assesses, and writes advisories regarding \nall the latest software vulnerabilities disclosed to the public. These \nadvisories are gathered in a publicly available database at the \nSecunia website: \n \nhttp://secunia.com/ \n \nSecunia offers services to our customers enabling them to receive all \nrelevant vulnerability information to their specific system \nconfiguration. \n \nSecunia offers a FREE mailing list called Secunia Security Advisories: \n \nhttp://secunia.com/secunia_security_advisories/ \n \n====================================================================== \n9) Verification \n \nPlease verify this advisory by visiting the Secunia website: \nhttp://secunia.com/secunia_research/2005-39/advisory/ \n \nComplete list of vulnerability reports published by Secunia Research: \nhttp://secunia.com/secunia_research/ \n \n====================================================================== \n \n \n`\n"}

{}