CVE-2012-1918: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in 1 compose.php and 2 libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. dot dot in the Attachment parameter...

CVE-2012-1919: Improper Control of Generation of Code

CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. dot dot in the file parameter...

CVE-2012-1917: Improper Limitation of a Pathname to a Restricted Directory

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

CVE-2012-1916: Undefined Security Weakness

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

AtMail 1.04 - Multiple Vulnerabilities

AtMail 1.04 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/52684/info AtMail is prone to multiple directory-traversal vulnerabilities, an arbitrary-file-upload vulnerability, and an information-disclosure vulnerability because the application fails to sanitize user-supplied...

AtMail 1.04 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/52684/info AtMail is prone to multiple directory-traversal vulnerabilities, an arbitrary-file-upload vulnerability, and an information-disclosure vulnerability because the application fails to sanitize user-supplied input. An attacker can exploit these...

ATMAIL WebMail Admin 6.3.4 Cross Site Scripting

Title: ====== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities Date: ===== 2012-01-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=376 VL-ID: ===== 376 Introduction: ============= Atmail is a commercial Linux messaging platform provider. The company was founded...

ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities

Document Title: =============== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=376 Release Date: ============= 2012-01-07 Vulnerability Laboratory ID VL-ID: ==================================== 376...

ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities

Document Title: =============== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=376 Release Date: ============= 2012-01-07 Vulnerability Laboratory ID VL-ID: ==================================== 376...

ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities

Document Title: =============== ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=375 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 375...

ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities

Document Title: =============== ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=375 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 375...

PT-2011-48: Multiple Vulnerabilities in AtMail

Specialists from the Positive Technologies Research Center have revealed multiple vulnerabilities in the AtMail webmail interface. 1. Arbitrary Files Loading The system allows one to load files attached to email letters. File extension is not checked; thus, arbitrary files including .php files ca...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

CVE-2011-4540

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

CVE-2011-4540

AtMail Open (Open-Source edition) 1.04 contains multiple XSS vulnerabilities exploitable via the func parameter to ldap.php or search.php. Remote attackers could inject arbitrary web script/HTML, with impact limited to partial integrity and no confidentiality/availability impact per the CVE metad...

CVE-2011-4540

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

AtMail 1.04 - 'func' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/50877/info AtMail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

AtMail 1.04 - func Multiple Cross-Site Scripting Vulnerabilities

AtMail 1.04 - func Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/50877/info AtMail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

CVE-2011-4540: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AtMail Open aka AtMail Open-Source edition 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to 1 ldap.php or 2 search.php...

Atmail WebMail < 6.2.0 (6.20) 'MailType' Parameter XSS

According to its version, the Atmail WebMail install on the remote host is earlier than 6.2.0 6.20. Such versions are affected by a cross-site scripting vulnerability because they fail to sanitize the 'MailType' parameter before using it to generate dynamic HTML content. An unauthenticated, remot...