CVE-2009-4363

CVE-2009-4363 affects Horde Framework components (Text_Filter/lib/Horde/Text/Filter/Xss.php) and related Horde Groupware packages, where data: URIs in HTML email HREF attributes could trigger cross-site scripting. Root cause is improper handling of data: URIs; vendor notes issue tied to Firefox. ...

Cross site scripting

functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets CSS positioning in HTML e-mail messages, which allows remote attackers to spoof the user interface, and conduct cross-site scripting XSS and phishing attacks, via a crafted...

Cross site scripting

Cross-site scripting XSS vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail...

CVE-2009-1047

CVE-2009-1047 is a Drupal XSS vulnerability in the Send by e-mail module of the Printer, e-mail and PDF versions module. The issue affects Drupal 5.x before 5.x-4.4 and 6.x before 6.x-1.4, enabling remote attackers to inject arbitrary web script or HTML via outbound HTML e-mail. Impact is web ses...

CVE-2009-1047

Cross-site scripting XSS vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the 1 User.id and 2 Library.queryText parameters to gw/webacc, and other vectors involving 3 HTML e-mai...

CVE-2008-5734

Cross-site scripting XSS vulnerability in WebMail Pro in IceWarp Software Merak Mail Server 9.3.2 allows remote attackers to inject arbitrary web script or HTML via an IMG element in an HTML e-mail message...

CVE-2008-3824

Cross-site scripting XSS vulnerability in 1 TextFilter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and 2 externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / slash characters as replacements for spaces in an...

CVE-2008-3824

CVE-2008-3824 affects Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2, and Popoon (externalinput.php in Popoon r22196 and earlier). It is a cross-site scripting (XSS) vulnerability allowing remote attackers to inject arbitrary web script or HTML by using / characters as replacements for spaces in...

CVE-2008-3824

Cross-site scripting XSS vulnerability in 1 TextFilter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and 2 externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / slash characters as replacements for spaces in an...

CVE-2003-1505

Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service crash by creating a web page or HTML e-mail with a textarea in a div element whose scrollbar-base-color is modified by a CSS style, which is then moved...

CVE-2003-1505

Vulnerability summary (CVE-2003-1505): Microsoft Internet Explorer 6.0 is vulnerable to a remote denial of service (crash) by crafted HTML/CSS. Specifically, a page or HTML email containing a textarea inside a div whose scrollbar-base-color is modified via CSS and then moved can trigger the crash...

CVE-2003-1440

SpamProbe 0.8a is affected: remote DoS via HTML e-mail containing newline characters inside an href tag, due to how certain regular expressions are not handling this input. The root cause is the incorrect handling of newlines in href attributes. Impact is described as a crash/partial availability...

CVE-2006-6701

Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...

UebiMiau Webmail System Security Vulnerability

I.Vulnerability UebiMiau Webmail System Cross Site Scripting Vulnerability II.Vendor Aldoir Ventura III.Affected Systems UebiMiau 2.7.9 latest release and probably previous versions. IV.About UebiMiau is a simple, yet efficient mail reader webmail supporting both IMAP and POP3 without dependence ...

CVE-2005-3895

Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary w...

Opera Web Browser 8.0/8.5 - HTML Form Status Bar Misrepresentation

source: https://www.securityfocus.com/bid/15472/info A vulnerability has been identified in Opera Web browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site. This vulnerability would most...

Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)

There is a vulnerability in Authenticode that, under certain low memory conditions, could allow an ActiveX control to download and install without presenting the user with an approval dialog. To exploit this vulnerability, an attacker could host a malicious Web Site designed to exploit this...

Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)

There is a vulnerability in Authenticode that, under certain low memory conditions, could allow an ActiveX control to download and install without presenting the user with an approval dialog. SPDX-FileCopyrightText: 2003 Jeff Adams Some text descriptions might be excerpted from a referenced...

Buffer Overflow in Windows Troubleshooter ActiveX Control (826232)

A security vulnerability exists in the Microsoft Local Troubleshooter ActiveX control in Windows 2000. The vulnerability exists because the ActiveX control Tshoot.ocx contains a buffer overflow that could allow an attacker to run code of their choice on a user's system. To exploit this...