CVE-2006-0331

Buffer overflow in Change passwd 3.1 chpasswd SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments...

Ubuntu 4.10 : php4 vulnerabilities (USN-99-2)

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...

Slackware 10.2 / current : PHP (SSA:2005-310-05)

New PHP packages are available for Slackware 10.2 and -current to fix minor security issues relating to the overwriting of the GLOBALS array. It has been reported here that this new version of PHP also breaks squirrelmail and probably some other things. Given the vague nature of the security...

SquirrelMail From Email header HTML injection vulnerability

The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

SquirrelMail < 1.4.4 XSS Vulnerabilities

The target is running at least one instance of SquirrelMail whose version number suggests it is vulnerable to one or more cross-site scripting vulnerabilities : - Insufficient escaping of integer variables in webmail.php allows a remote attacker to include HTML / script into a SquirrelMail webpag...

SquirrelMail Cross-Site Scripting Vulnerability

The remote host seems to be vulnerable to a security problem in SquirrelMail. Its script SPDX-FileCopyrightText: 2005 Xue Yong Zhi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SquirrelMail Detection

Detection of SquirrelMail. The script sends a connection request to the server and attempts to detect SquirrelMail and to extract its version. SPDX-FileCopyrightText: 2005 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2005-3128

Cross-site scripting XSS vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG tag...

CVE-2005-3128

CVE-2005-3128 is a cross-site scripting vulnerability in the Address Add Plugin for SquirrelMail (versions 1.9 and 2.0) where the add.php functionality fails to sanitize input, allowing an attacker to inject arbitrary script via the IMG tag . The vulnerability could enable execution of script in ...

CVE-2005-3128

Cross-site scripting XSS vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG tag...

[Full-disclosure] SquirrelMail Address Add Plugin XSS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0002 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ SquirrelMail Address Add Plugin XSS +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Sep 28, 2005 PUBLISHED AT...

SquirrelMail 1.4.2 Address Add Plugin - add.php Cross-Site Scripting

SquirrelMail 1.4.2 Address Add Plugin - add.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14973/info SquirrelMail Address Add Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue...

SquirrelMail 1.4.2 Address Add Plugin - &#039;add.php&#039; Cross-Site Scripting

source: https://www.securityfocus.com/bid/14973/info SquirrelMail Address Add Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in...

Fedora Core 3 : squirrelmail-1.4.4-1.FC3 (2005-260)

Multiple issues in squirrelmail CVE-2005-0104 Upgrade to 1.4.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora Core 4 : squirrelmail-1.4.6-0.cvs20050812.1.fc4 (2005-780)

It probably is not a good idea to push a CVS snapshot here, but upstream screwed up their 1.4.5 release and CVS contains further fixes like PHP5 related stuff that might make squirrelmail usable on FC4. This snapshot worked on my personal server for the past week, so hopefully it will be good for...

Fedora Core 3 : squirrelmail-1.4.6-0.cvs20050812.1.fc3 (2005-779)

It probably is not a good idea to push a CVS snapshot here, but upstream screwed up their 1.4.5 release and CVS contains further fixes like PHP5 related stuff that might make squirrelmail usable on FC4. This snapshot worked on my personal server for the past week, so hopefully it will be good for...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595-02 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released...

RHEL 4 : squirrelmail (RHSA-2005:595)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:595 advisory. SquirrelMail is a standards-based webmail package written in PHP4. A bug was found in the way SquirrelMail handled the $POST variable. If a...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released wi...

security flaw

optionsidentities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS attacks, and write arbitrary files...