EUVD-2011-4466

Malware in sbrugna...

Crlf injection

CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. dot dot in the file parameter...

Code injection

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1917

CVE-2012-1917 affects AtMail Open-Source (compose.php in the @Mail WebMail Client) prior to version 1.05. The root cause is improper handling of ../ sequences in the unique parameter, allowing remote attackers to perform directory traversal and read arbitrary files via a ..././ sequence. Document...

CVE-2012-1920

@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function...

CVE-2012-1916

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1919

CVE-2012-1919 affects AtMail Open-Source’s @Mail WebMail Client (mime.php) prior to version 1.05. The vulnerability is a CRLF injection that allows a remote attacker to perform directory traversal and read arbitrary files by injecting a %0A sequence followed by .. in the file parameter, enabling ...

CVE-2012-1920

The CVE-2012-1920 issue affects the @Mail WebMail Client in AtMail Open-Source 1.04 and earlier. A remote attacker can obtain configuration information by issuing a direct request to install/info.php, which calls phpinfo. This is an information-disclosure vulnerability in the WebMail component. T...

CVE-2012-1916: Undefined Security Weakness

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

PT-2012-3651

Name of the Vulnerable Software and Affected Versions AtMail Open-Source versions prior to 1.05 Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities are located in the compose.php and libs/Atmail/SendMsg.php files of the @Mail WebMail Client in AtMail...

CVE-2012-1919: Improper Control of Generation of Code

CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. dot dot in the file parameter...

PT-2012-3650

Name of the Vulnerable Software and Affected Versions AtMail Open-Source version 1.05 and earlier Description The issue concerns the compose.php file in the @Mail WebMail Client, which does not properly handle ../ dot dot slash sequences in the unique parameter. This allows remote attackers to...

PT-2012-3653

Name of the Vulnerable Software and Affected Versions AtMail Open-Source versions 1.04 and earlier Description The issue allows remote attackers to obtain configuration information by making a direct request to "install/info.php", which calls the phpinfo function. Recommendations For AtMail...

PT-2012-3649

Name of the Vulnerable Software and Affected Versions AtMail Open-Source @Mail WebMail Client version prior to 1.05 Description The issue allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension. This leads to the creation of an executable file under...

CVE-2012-1917: Improper Limitation of a Pathname to a Restricted Directory

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

CVE-2012-1920: Exposure of Sensitive Information to an Unauthorized Actor

@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

CVE-2011-4540

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

CVE-2011-4540: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

PT-2011-4975

Name of the Vulnerable Software and Affected Versions AtMail Open versions 1.04 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the func parameter in the "ldap.php"...