IceWarp Merak Mail Server < 9.4.2 Multiple Vulnerabilities

IceWarp Merak Mail Server is prone to multiple vulnerabilities. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

CVE-2009-1467

CVE-2009-1467 affects IceWarp WebMail Server and IceWarp eMail Server prior to version 9.4.2. The vulnerability is an XSS flaw in RSS feed handling and email view: the RSS feed item’s title and href are inserted unmodified, while the description is sanitized via cleanHTML, per the getHTML and RSS...

[RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted Cross Site Scripting attacks in its RSS feed reader. If attackers control or compromise an RSS...

CVE-2009-1467

creationtimestamp| type| source ---|---|--- 2009-05-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32969 2009-05-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32985...

[RT-SA-2009-001] IceWarp WebMail Server: Cross Site Scripting in Email View

Advisory: IceWarp WebMail Server: Cross Site Scripting in Email View During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to Cross Site Scripting attacks in its email view. This enables attackers to send emails with embedded JavaScript code, for exampl...

IceWarp WebMail RSS Feed XSS

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted Cross Site Scripting attacks in its RSS feed reader. If attackers control or compromise an RSS...

IceWarp WebMail Email View XSS

Advisory: IceWarp WebMail Server: Cross Site Scripting in Email View During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to Cross Site Scripting attacks in its email view. This enables attackers to send emails with embedded JavaScript code, for exampl...

Fedora Update for centerim FEDORA-2008-2867

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

FreeBSD Ports: ethereal*, tethereal*

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Fedora 8 : centerim-4.22.4-1.fc8 (2008-2867)

This update fixes the CVE-2008-1467 security issue by disabling the 'actions' configuration altogether. Furthermore the default web browser is no longer configurable in CenterIM. The links get open in the default web browser configured, using xdg-utils. This release adds support for new versions ...

Fedora 7 : centerim-4.22.4-1.fc7.1 (2008-2869)

This update fixes the CVE-2008-1467 security issue by disabling the 'actions' configuration altogether. Furthermore the default web browser is no longer configurable in CenterIM. The links get open in the default web browser configured, using xdg-utils. There won't be any update for centericq. Al...

CVE-2008-1467

CVE-2008-1467 affects CenterIM 4.22.3 and earlier, where user-assisted remote attackers could trigger command execution via shell metacharacters in a URI (related to received URLs in the message window). Fedora/openvas entries record updates (FEDORA-2008-2867/2869) that fix the issue, noting that...

CVE-2008-1467

creationtimestamp| type| source ---|---|--- 2008-03-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/5283...

CVE-2003-1467

CVE-2003-1467 covers multiple XSS flaws in Phorum prior to 3.4.3 affecting login.php, register.php, post.php, and common.php. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. Affected software: Phorum (before 3.4.3). Underlying cause an...

CVE-2007-1467

The CVE-2007-1467 entry describes multiple cross-site scripting (XSS) vulnerabilities affecting Cisco Secure Access Control Server and related Cisco products. The root issue is insufficient input filtering in the search form used by PreSearch.html and PreSearch.class, allowing remote attackers to...

CentOS 3 / 4 : ethereal (CESA-2005:427)

Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network traffic. A number of security flaws have been...

Apple iTunes fails to properly parse AAC files

Overview Apple iTunes does not properly parse AAC files. This vulnerability may allow a remote attacker to execute arbitrary code. Description Apple iTunes Apple iTunes is a digital media player available for the Microsoft Windows and Mac OS X operating systems. Advanced Audio Coding AAC file...

CVE-2006-1467

Apple iTunes prior to 6.0.5 on macOS 10.2.8+ and Windows XP/2000 is affected by an integer overflow in the AAC file parser (STSZ sample_size_table) that can lead to remote code execution when a user opens a crafted AAC file. Exploitation requires user action and would run with the caller’s privil...

iTunes < 6.0.5 AAC File Integer Overflow (Mac OS X)

The remote host is running iTunes, a popular jukebox program. The remote version of this software is vulnerable to an integer overflow when it parses specially crafted AAC files which may lead to the execution of arbitrary code. An attacker may exploit this flaw by sending a malformed AAC file to...

CVE-2005-1467

CVE-2005-1467 concerns an unknown vulnerability in the NDPS dissector of Ethereal before 0.10.11 that could allow a remote attacker to cause a denial of service by exhausting memory via unknown vectors. The echoing connected sources corroborate that Ethereal (tethereal) before 0.10.11 is affected...