IceWarp Merak Mail Server < 9.0.0 BODY Element XSS

The remote host is running IceWarp Merak Mail Server - a webmail server for Windows and Linux. According to its banner, the version of IceWarp installed on the remote host fails to properly sanitize email messages before displaying them. If a user reads a specially crafted message, a remote...

IceWarp < 5.6.1 lang_settings Parameter Remote File Inclusion (deprecated)

Binary data 3688.prm...

Secunia Research: IceWarp Web Mail Two File Inclusion Vulnerabilities

====================================================================== Secunia Research 17/07/2006 - IceWarp Web Mail Two File Inclusion Vulnerabilities - ====================================================================== Table of Contents Affected...

IceWarp Multiple Script Remote File Inclusion

The remote host is running IceWarp Web Mail, a webmail product written in PHP that is distributed as a standalone application and is also bundled with VisNetic Mail Server and Merak Mail Server. The version of IceWarp Web Mail installed on the remote host fails to sanitize user-supplied input to...

CVE-2006-0817

CVE-2006-0817 is a directory traversal/remote file inclusion vulnerability in IceWarp Web Mail bundled with Merak/VisNetic Mail Server. The flaw stems from improper sanitization in the language/lang_settings parameters via the securepath function in accounts/inc/include.php and admin/inc/include....

CVE-2006-2484

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

CVE-2006-2484

Cross-site scripting XSS vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter...

CVE-2006-2484

CVE-2006-2484 affects IceWarp WebMail

IceWarp Cross-Site Scripting&#40;XSS&#41;

======================= Discovery by:LiNuXrOOt Site:www.alshmokh.com E-mail:[email protected] ======================= Example: /extendlicense/index.html?PHPSESSID=XSS...

CVE-2005-4556

PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when registerglobals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the 1 langsettings and 2...

CVE-2005-4559

mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the defaultlayout and layoutsettings variables when an unrecognized HTTPUSERAGENT string is provided, which allows remote attackers to acce...

CVE-2005-4557

dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte %00 in the lang parameter, possibly due to a directory traversal vulnerability...

CVE-2005-4558

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include...

CVE-2005-4557

CVE-2005-4557 affects IceWarp Web Mail 5.5.1 (as used by Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1). The issue is a remote inclusion vulnerability: an attacker can cause the system to include arbitrary local files via a null byte (%00) in the lang parameter, likely due to a ...

CVE-2005-4559

CVE-2005-4559 affects IceWarp Web Mail 5.5.1 (as used by Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1). The issue lies in mail/include.html where default_layout and layout_settings are not properly initialized when an unrecognized HTTP_USER_AGENT is sent. This allows remote att...

CVE-2005-4558

CVE-2005-4558 affects IceWarp Web Mail 5.5.1 (used by Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1). The issue arises in mail/index.html where the language parameter lang_settings is not properly restricted before storage in the database, allowing remote authenticated users to ...

CVE-2005-4556

CVE-2005-4556 affects IceWarp Web Mail 5.5.1 (used by Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1). When register_globals is on, remote attackers can exploit PHP remote file include via the lang_settings and language parameters in accounts/inc/include.php and admin/inc/include...

CVE-2005-4556

PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when registerglobals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the 1 langsettings and 2...

CVE-2005-4558

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include...