[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595-02 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released wi...

Moderate: Red Hat Security Advisory: squirrelmail security update

An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released with this errata contained a bug which rendered the...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

CVE-2005-2428

Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

CVE-2005-2428: Undefined Security Weakness

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

atmailXSS.txt

@Mail multiple variable cross-site scripting vendor url:http://www.atmail.com Advisory:http://lostmon.blogspot.com/2005/07/ mail-multiple-variable-cross-site.html vendor notify:yes exploit available: yes @Mail is a feature rich Email solution that allows users to access email-resources via the we...

SquirrelMail Arbitrary Variable Overwriting Vulnerability

GulfTech Security Research July 14th, 2005 Vendor : The SquirrelMail Project Team URL : http://www.squirrelmail.org/ Version : SquirrelMail 1.4.5-RC1 && Earlier Risk : Variable Overwriting Description: SquirrelMail is a standards-based webmail package written in php. It includes built-in pure PHP...

CVE-2001-1537

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges...

CVE-2001-1537

The CVE concerns TWIG webmail versions 2.7.4 and earlier where the default 'basic' security setting in config.php stores cleartext usernames and passwords in cookies. This could allow an attacker to obtain authentication information and gain privileges. The PT-2001-2622 entry reiterates the affec...

CVE-2001-1537: Cleartext Storage of Sensitive Information

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges...

[SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 756-1 [email protected] http://www.debian.org/security/ Martin Schulze July 13th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 756-1 [email protected] http://www.debian.org/security/ Martin Schulze July 13th, 2005 http://www.debian.org/security/faq -...

GLSA-200506-19 : SquirrelMail: Several XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200506-19 SquirrelMail: Several XSS vulnerabilities SquirrelMail is vulnerable to several cross-site scripting issues, most reported by Martijn Brinkers. Impact : By enticing a user to read a specially crafted e-mail or using a...

CVE-2002-1710

BasiliX Webmail 1.1.0 (or lower) contains an Arbitrary File Disclosure vulnerability in the attachment handling of Compose Mail. The PHP-based script accepts a list of attachment names from the client but does not verify that those attachments were actually uploaded, allowing an attacker to retri...

CVE-2002-1708

Cross-site scripting vulnerability XSS in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the 1 subject or 2 message fields...

CVE-2002-1710

The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file...

CVE-2002-1709

CVE-2002-1709 describes a SQL injection vulnerability in BasiliX Webmail, where the vulnerable vector is the id parameter. The OpenVAS entries indicate that remote servers running BasiliX Webmail version 1.1.0 or lower are potentially vulnerable, with susceptibility depending on the installed PHP...