DSA-1154 squirrelmail - variable overwriting

Bulletin has no description...

Roxio Toast 7 - DejaVu Component PATH Variable Privilege Escalation

Roxio Toast 7 - DejaVu Component PATH Variable Privilege Escalation source: https://www.securityfocus.com/bid/19596/info Roxio Toast is prone to a local privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. As a result, local users may set their own search...

CVE-2006-4019

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users...

CVE-2006-4019

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users...

CVE-2006-4019

CVE-2006-4019 affects SquirrelMail up to version 1.4.7, where a dynamic variable evaluation flaw in compose.php can allow an attacker to overwrite variables used by the script and influence actions, potentially reading/writing attachments and other users’ preferences. The issue stems from unsafe ...

squirrelmail -- random variable overwrite vulnerability

The SquirrelMail developers report: A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments...

IIS IDA/IDQ Path Disclosure

IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions. An attacker may use this flaw to gain more information about the remote host, and hence make more focused attacks. OpenVAS Vulnerability Test $Id:...

HTTP login page

This script logs onto a web server through a login page and stores the authentication / session cookie. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Debian DSA-756-1 : squirrelmail - several vulnerabilities

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1769 Martijn Brinkers discovered cross-site scripting vulnerabilities that allow remote attackers to inject...

CVE-2005-2095

optionsidentities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS attacks, and write arbitrary files...

FreeBSD : mozilla -- arbitrary code execution vulnerability (cbfde1cd-87eb-11d9-aa18-0001020eed82)

A Mozilla Foundation Security Advisory reports : Plugins such as flash can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's 'Fireflashing' example demonstrates that an attacker can op...

Mozilla Suite: Multiple vulnerabilities

Background The Mozilla Suite is a popular all-in-one web browser that includes a mail and news reader. Description The following vulnerabilities were found and fixed in the Mozilla Suite: Mark Dowd from ISS X-Force reported an exploitable heap overrun in the GIF processing of obsolete Netscape...

security flaw

prefs.php in SquirrelMail before 1.4.4, with registerglobals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers...

[SA13993] ginp Java Preferences API Security Bypass

TITLE: ginp Java Preferences API Security Bypass SECUNIA ADVISORY ID: SA13993 VERIFY ADVISORY: http://secunia.com/advisories/13993/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: ginp 0.x http://secunia.com/product/4566/ DESCRIPTION: A security issue has been reporte...

CVE-2003-0883

The System Preferences capability in Mac OS X before 10.3 allows local users to access secure Preference Panes for a short period after an administrator has authenticated to the system...

CVE-2003-0880

CVE-2003-0880 involves a vulnerability in Mac OS X prior to 10.3 where local users could access Dock functions from behind Screen Effects when Full Keyboard Access is enabled via the Keyboard pane in System Preferences. The description labels the vulnerability as Unknown, with no publicly provide...

CVE-2003-0883

The System Preferences capability in Mac OS X before 10.3 allows local users to access secure Preference Panes for a short period after an administrator has authenticated to the system...

CVE-2003-0883

CVE-2003-0883 affects the System Preferences capability in Mac OS X prior to 10.3. Local users can access secure Preference Panes for a short period after an administrator authenticates, exposing partial confidentiality/integrity/availability impacts. The CVSS base score is 4.6 (MEDIUM) with loca...

CVE-2002-1204

Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the userpref function and accessing the prefs.js file, which is stored in a...

CVE-2002-1204

CVE-2002-1204 affects Netscape Communicator 4.x. The vulnerability allows an attacker to steal a user’s preferences (e.g., URL history, e‑mail address, and potentially the e‑mail password) by redefining the user_pref() function and reading prefs.js, which is stored in a directory with a predictab...