58 matches found
IlohaMail < 0.8.14-RC3 read_message.php Multiple Field HTML Injection
Binary data 2828.prm...
IlohaMail Configuration Scripts Remote Disclosure
The remote host is running Ilohamail, a web-based mail interface written in PHP. The remote installation of this software is not configured properly, in the sense that it allows any user to download its configuration files by requesting the '/conf/conf.inc' or '/conf/customauth.inc' file. The...
IlohaMail Insecure Configuration Files
------------------------------------------------ Advisory Name : IlohaMail Insecure Configuration Files Release Date : 10 January, 2004 Application : IlohaMail http://ilohamail.org/ Vulnerable: IlohaMail-0.8.14-rc1 and lower Not Vulnerable: IlohaMail-0.8.14-rc2 Author : SRR Project Group of Ready...
IlohaMail Multiple Configuration Files Remote Information Disclosure
The target is running at least one instance of IlohaMail that allows anyone to retrieve its configuration files over the web. These files may contain sensitive information. For example, conf/conf.inc may hold a username / password used for SMTP authentication. %NASLMINLEVEL 70300 This script was...
CVE-2004-2500
Unknown vulnerability in IlohaMail before 0.8.14-rc1 has unknown impact and attack vectors...
IlohaMail < 0.8.14RC1 Unspecified Vulnerability
The remote host is running at least one instance of IlohaMail version 0.8.13 or earlier. Such versions are reportedly affected by an unspecified vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid15935;...
[SA13413] IlohaMail Unspecified Vulnerability
TITLE: IlohaMail Unspecified Vulnerability SECUNIA ADVISORY ID: SA13413 VERIFY ADVISORY: http://secunia.com/advisories/13413/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: IlohaMail 0.8.x http://secunia.com/product/1039/ DESCRIPTION: A vulnerability with an unknown...
IlohaMail < 0.8.14-RC1 Unspecified Vulnerability
Binary data 2451.prm...
IlohaMail Software Detection
The remote host is running IlohaMail, a webmail application that is based on a stock build of PHP and that does not require either a database or a separate IMAP library. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See the Nessus Scripts License for details...
IlohaMail index.php session Parameter Arbitrary File Access
The target is running at least one instance of IlohaMail version 0.7.11 or earlier. Such versions contain a flaw in the processing of the session variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user, provided the filesystem backend is in use...
IlohaMail Forged GET/POST Arbitrary Contacts Deletion
The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions contain a flaw that enables an authenticated user to delete contacts belonging to any user provided the DB-based backend is used to store contacts. The flaw arises because ownership of 'deleteitem...
IlohaMail Attachment Arbitrary File Create/Overwrite
The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions do not properly check the upload path for file attachments, which could allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use...
IlohaMail user Parameter XSS
According to its banner, the remote web server is running IlohaMail version 0.8.10 or earlier. Such versions do not properly sanitize the 'user' parameter before using it to generate dynamic HTML output. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user...
IlohaMail index.php init_lang Parameter Arbitrary File Access
The target is running at least one instance of IlohaMail version 0.7.10 or earlier. Such versions contain a flaw in the processing of the language variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user. %NASLMINLEVEL 70300 This script was written by...
IlohaMail Multiple External Programs Arbitrary Command Execution
The target is running at least one instance of IlohaMail version 0.8.6. This version may contain flaws in the spell check and GnuPG features that allow an authenticated attacker to run arbitrary commands with the privileges of the web user simply by enclosing them in backticks when spell checking...
IlohaMail Unspecified Database Password Disclosure Weakness
The target is running at least one instance of IlohaMail version 0.6 or earlier. Such versions suffer from a potential password disclosure problem when databasae information is not saved in the session table. Nessus has determined the vulnerability exists on the target simply by looking at the...
IlohaMail Email Header XSS
The remote host is running at least one instance of IlohaMail version 0.8.12 or earlier. Such versions do not properly sanitize message headers, leaving users vulnerable to XSS attacks. For example, a remote attacker could inject JavaScript code that steals the user's session cookie and thereby...
[Full-Disclosure] RS-2004-2: "Content-Type" XSS vulnerability affecting other webmail systems
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================== - RS-Labs Security Advisory - =============================== Tittle: "Content-Type" XSS vulnerability affecting other webmail systems ID: RS-2004-2 Severity: Medium / High - Arbitrary tags injection in victim's browser...