CommuniGate Pro WebMail URI解析HTML注入漏洞

BUGTRAQ: 35783 Communigate Pro邮件服务器存在存储式跨站脚本漏洞。如果远程攻击者提交了包含有特制URL的纯文本邮件消息的话，就会在用户阅读邮件时执行嵌入的JavaScript代码。成功利用这个漏洞的攻击者可以窃取敏感信息或执行HTML或脚本代码。 Communigate Pro 5.2.14 厂商补丁： Stalker ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.communigate.com/cgatepro/History52.html...

CommuniGate Pro WebMail < 5.2.15 XSS

According to its banner, the remote web server is from a version of CommuniGate Pro older than 5.2.15. The webmail component of such versions fails to correctly parse plaintext email messages containing malicious URL links before displaying the message to the user. By sending a specially crafted...

CommuniGate Pro Web Mail URI Parsing HTML Injection Vulnerability

CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to contr...

CommuniGate Pro Web Mail URI Parsing HTML Injection Vulnerability

CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Communigate Pro crossite scripting

Crossite scripting on URLs inside message...

Stored XSS on Communigate Pro 5.2.14 and prior versions

Description The Communigate Pro webmail framework is prone to a stored Cross Site Scripting vulnerability through crafted plain text email messages. - Affected version: 5.2.14 and prior as reported from Communigate: http://www.communigate.com/cgatepro/History52.html - Details This vulnerability...

Communigate Pro Cross Site Scripting

Description The Communigate Pro webmail framework is prone to a stored Cross Site Scripting vulnerability through crafted plain text email messages. - Affected version: 5.2.14 and prior as reported from Communigate: http://www.communigate.com/cgatepro/History52.html - Details This vulnerability...

CommuniGate Pro 5.2.14 - Web Mail URI Parsing HTML Injection

CommuniGate Pro 5.2.14 - Web Mail URI Parsing HTML Injection source: https://www.securityfocus.com/bid/35783/info CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to run HTML and...

CommuniGate Pro 5.2.14 - Web Mail URI Parsing HTML Injection

source: https://www.securityfocus.com/bid/35783/info CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to run HTML and script code in the context of the affected site, to steal...

CVE-2002-2375

Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a 1 .. dot dot or 2 . dot in a URL. NOTE: it is not clear whether this issue reveals any more information...

CVE-2002-2375

The CVE-2002-2375 entry concerns CommuniGate Pro (verified: 4.0b4 and potentially earlier) with a directory traversal flaw in the WebUser component. The underlying issue allows remote attackers to enumerate the WebUser directory and its parent by using URL path components “..” or “.”. Impact is d...

CVE-2002-2375: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a 1 .. dot dot or 2 . dot in a URL. NOTE: it is not clear whether this issue reveals any more information...

CVE-2003-1481

CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...

CVE-2003-1481

CommuniGate Pro versions 3.1–4.0.6 are affected by a flaw where the session ID is exposed in the Referer header of an image request. This enables remote attackers to hijack mail sessions by sending an email containing an IMG tag referencing a malicious URL that captures the Referer. Impact is use...

CVE-2003-1481: Exposure of Sensitive Information to an Unauthorized Actor

CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...

CommuniGate Pro POP3 < 5.1c2 Buffer Overflow

Binary data 5104.prm...

CVE-2007-2718

Cross-site scripting XSS vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags...

Cross site scripting

Cross-site scripting XSS vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags...

CVE-2007-2718

Cross-site scripting XSS vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags...

CVE-2007-2718

CVE-2007-2718 describes a cross-site scripting (XSS) vulnerability in the WebMail component of Stalker CommuniGate Pro 5.1.8 and earlier when accessed via Microsoft Internet Explorer . The issue allows a remote attacker to inject arbitrary web script or HTML through crafted STYLE tags . The vulne...