IlohaMail < 0.7.9 Contacts Deletion Vulnerability

IlohaMail contains a flaw that enables an authenticated user to delete contacts belonging to any user provided the DB-based backend is used to store contacts. The flaw arises because ownership of SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted from a...

IlohaMail Arbitrary File Access via Language Variable

The target is running at least one instance of IlohaMail version 0.7.10 or earlier. Such versions contain a flaw in the processing of the language variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user. SPDX-FileCopyrightText: 2004-2005 George A...

IlohaMail Arbitrary File Access via Session Variable Vulnerability

The target is running at least one instance of IlohaMail version 0.7.11 or earlier. Such versions contain a flaw in the processing of the session variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user, provided the filesystem backend is in use...

IlohaMail Readable Configuration Files

The target is running at least one instance of IlohaMail that allows anyone to retrieve its configuration files over the web. These files may contain sensitive information. For example, conf/conf.inc may hold a username / password used for SMTP authentication. OpenVAS Vulnerability Test $Id:...

IlohaMail Password Disclosure Vulnerability

The target is running at least one instance of IlohaMail version 0.6 or earlier. Such versions suffer from a potential password disclosure problem when databasae information is not saved in the session table. OpenVAS has determined the vulnerability exists on the target simply by looking at the...

IlohaMail Contacts Deletion Vulnerability

The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions contain a flaw that enables an authenticated user to delete contacts belonging to any user provided the DB-based backend is used to store contacts. The flaw arises because ownership of 'deleteitem...

IlohaMail Detection (HTTP)

HTTP based detection of IlohaMail. SPDX-FileCopyrightText: 2005 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.14629";...

IlohaMail Readable Configuration Files

The target is running at least one instance of IlohaMail that allows anyone to retrieve its configuration files over the web. These files may contain sensitive information. For example, conf/conf.inc may hold a username / password used for SMTP authentication. SPDX-FileCopyrightText: 2005 George ...

IlohaMail 0.8.6 External Programs Vulnerabilities

IlohaMail may contain flaws in the spell check and GnuPG features that allow an authenticated attacker to run arbitrary commands with the privileges of the web user simply by enclosing them in backticks when spell checking or sending a message. SPDX-FileCopyrightText: 2004 George A. Theall Some...

IlohaMail External Programs Vulnerabilities

The target is running at least one instance of IlohaMail version 0.8.6. This version may contain flaws in the spell check and GnuPG features that allow an authenticated attacker to run arbitrary commands with the privileges of the web user simply by enclosing them in backticks when spell checking...

IlohaMail Arbitrary File Access via Language Variable

The target is running at least one instance of IlohaMail version 0.7.10 or earlier. Such versions contain a flaw in the processing of the language variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user. OpenVAS Vulnerability Test $Id:...

IlohaMail < 0.7.0 Password Disclosure Vulnerability

IlohaMail suffers from a potential password disclosure problem when databasae information is not saved in the session table. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

IlohaMail < 0.7.9 Attachment Upload Vulnerability

IlohaMail does not properly check the upload path for file attachments, which may allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted fro...

IlohaMail < 0.8.13 Email Header HTML Injection Vulnerability

IlohaMail does not properly sanitize message headers, leaving users vulnerable to cross-site scripting XSS attacks. For example, a remote attacker could inject Javascript code that steals the user SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted from a...

CVE-2004-2500

Unknown vulnerability in IlohaMail before 0.8.14-rc1 has unknown impact and attack vectors...

CVE-2004-2500

CVE-2004-2500 affects IlohaMail versions prior to 0.8.14RC1. The vulnerability is described as unspecified with unknown impact/vector in the CVE entry. Connected Nessus/NASL data corroborates an unspecified vulnerability affecting 0.8.13 or earlier and provides a remediation: upgrade to IlohaMail...

CVE-2005-1120

Multiple cross-site scripting XSS vulnerabilities in IlohaMail 0.8.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the e-mail 1 body, 2 filename, or 3 MIME type...

CVE-2005-1120

CVE-2005-1120 concerns IlohaMail up to version 0.8.14, where multiple XSS vulnerabilities exist in the e‑mail body, filename, or MIME type due to insufficient input sanitisation. The Debian advisory DSA-1010-1 documents that ilohamail does not properly sanitise user input, enabling remote attacke...

CVE-2005-1120

Multiple cross-site scripting XSS vulnerabilities in IlohaMail 0.8.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the e-mail 1 body, 2 filename, or 3 MIME type...

IlohaMail read_message.php Attachment Multiple Field XSS

Based on its version number, the installation of IlohaMail on the remote host does not properly sanitize attachment file names, MIME media types, and HTML / text email messages. An attacker can exploit these vulnerabilities by sending a specially crafted message to a user which, when read using a...