CVE-2005-0323: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Infinite Mobile Delivery Webmail 2.6 allows remote attackers to inject arbitrary web script or HTML via the URL...

PT-2005-1402 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Infinite Mobile Delivery Webmail version 2.6 Description: The issue allows remote attackers to gain sensitive information via an HTTP request containing invalid characters for a Windows folder name, which reveals the path in an error message...

SquirrelMail WebMail S/MIME Plugin unfiltered shell characters problem

Data from user's certificate is used to invoke external application without filtering...

CVE-2005-0104

CVE-2005-0104 is a cross-site scripting (XSS) vulnerability in SquirrelMail’s webmail.php prior to 1.4.4. The issue allows an attacker to inject arbitrary web script or HTML via certain integer variables, enabling an unchecked/unsanitized input path that can be reflected to users. Public referenc...

DeskNow Mail and Collaboration Server Directory Traversal

WebMail interface directory traversal...

Infinite Mobile Delivery Webmail Multiple Vulnerabilities (XSS, PD)

There are flaws in the remote Infinite Mobile Delivery, a web interface to provide wireless access to mail. This version of Infinite Mobile Delivery has a cross-site scripting vulnerability and a path disclosure vulnerability. An attacker, exploiting this flaw, would be able to steal user...

imd_advisory.txt

Vendor: Captaris, Inc. Date: January 29, 2005 Issue: XSS in Infinite Mobile Delivery v2.6 Webmail URL: http://www.capataris.com Advisory: http://www.lovebug.org/imdadvisory.txt Issue: The webmail portion of the latest and final release of Infinite Mobile Delivery contains a Cross Site Scripting...

XSS in Infinite Mobile Delivery v2.6 Webmail

Vendor: Captaris, Inc. Date: January 29, 2005 Issue: XSS in Infinite Mobile Delivery v2.6 Webmail URL: http://www.capataris.com Advisory: http://www.lovebug.org/imdadvisory.txt Issue: The webmail portion of the latest and final release of Infinite Mobile Delivery contains a Cross Site Scripting...

CVE-2005-0104

Cross-site scripting XSS vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables...

Captaris Infinite Mobile Delivery Webmail 2.6 - Full Path Disclosure

source: https://www.securityfocus.com/bid/12399/info Infinite Mobile Delivery Webmail is reportedly affected by a path disclosure vulnerability. This issue could permit a malicious user to expose the root path of the affected application. http://www-webmailusersite-com/username/Folder:?...

[SIG^2 G-TEC] Magic Winmail Server v4.0 Multiple Vulnerabilities

SIG^2 Vulnerability Research Advisory Magic Winmail Server v4.0 Multiple Vulnerabilities by Tan Chew Keong Release Date: 27 Jan 2005 ADVISORY URL http://www.security.org.sg/vuln/magicwinmail40.html SUMMARY Magic Winmail Server http://www.magicwinmail.net/ is an enterprise class mail server softwa...

SquirrelMail < 1.4.4-RC1 webmail.php XSS

Binary data 2550.prm...

IlohaMail Configuration Scripts Remote Disclosure

The remote host is running Ilohamail, a web-based mail interface written in PHP. The remote installation of this software is not configured properly, in the sense that it allows any user to download its configuration files by requesting the '/conf/conf.inc' or '/conf/customauth.inc' file. The...

CVE-2004-2547

NetWin 1 SurgeMail before 2.0c and 2 WebMail allow remote attackers to obtain sensitive information via HTTP requests that a specify the / URI, b specify the /scripts/ URI, or c specify a non-existent file, which reveal the path in an error message...

CVE-2004-2495

The 1 Webmail, 2 admin, and 3 SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service CPU consumption via a large number of simultaneous connections to the service...

CVE-2004-2537

Unspecified vulnerability in SurgeMail before 2.2c10 has unknown impact and attack vectors, related to a "Webmail security bug."...

CVE-2004-2334

Multiple cross-site scripting XSS vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via 1 a hex-encoded value to the variable parameter in emumail.fcgi, 2 the folder parameter in emumail.fcgi, or Javascript in the 3 username or 4 password field in...

CVE-2004-2385

EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information home directory via an HTTP request for init.emu...

CVE-2004-2458

Open WebMail 2.30 and earlier, when usesyshomedir is disabled or createsyshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories...

CVE-2004-2548

Multiple cross-site scripting XSS vulnerabilities in NetWin 1 SurgeMail before 2.0c and 2 WebMail allow remote attackers to inject arbitrary web script or HTML via a a URI containing the script, or b the username field in the login form. NOTE: it is possible that the first attack vector is...