GLSA-200506-19 : SquirrelMail: Several XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200506-19 SquirrelMail: Several XSS vulnerabilities SquirrelMail is vulnerable to several cross-site scripting issues, most reported by Martijn Brinkers. Impact : By enticing a user to read a specially crafted e-mail or using a...

SquirrelMail: Several XSS vulnerabilities

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP protocols. Description SquirrelMail is vulnerable to several cross-site scripting issues, most reported by Martijn Brinkers. Impact By enticing a user to read a specially-crafted e-mail or using a manipulated...

CVE-2005-1769

CVE-2005-1769 concerns multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail versions 1.4.0–1.4.4. The issues allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the URL or in an e-mail message. The weaknesses have a CVSS v2 base score of 4.3 ...

CVE-2005-1769

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in 1 the URL or 2 an e-mail message...

[SM-ANNOUNCE] Patch fixes SquirrelMail cross site scripting vulnerabilities [CAN-2005-1769]

Hello All, Several cross site scripting XSS vulnerabilties have been discovered in SquirrelMail versions 1.4.0 - 1.4.4. These have been addressed in a patch that can be found at 1. We advise all our users to apply this patch. We're also releasing SquirrelMail 1.4.5 release candidate 1 today. We...

CVE-2005-1769

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in 1 the URL or 2 an e-mail message...

CVE-2005-1769

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in 1 the URL or 2 an e-mail message...

SquirrelMail < 1.4.5 Multiple Vulnerabilities

Binary data 3016.prm...

SquirrelMail < 1.45 Multiple Vulnerabilities

According to its banner, the version of SquirrelMail installed on the remote host is prone to multiple flaws : - Post Variable Handling Vulnerabilities Using specially crafted POST requests, an attacker may be able to set random variables in the file 'optionsidentities.php', which could lead to...

squirrelmail -- Several cross site scripting vulnerabilities

A SquirrelMail Security Advisory reports: Several cross site scripting XSS vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4. The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email ...

Fedora Core 2 : squirrelmail-1.4.4-1.FC2 (2005-259)

Multiple issues in squirrelmail CVE-2005-0104 Upgrade to 1.4.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

CVE-2005-0239

viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter...

CVE-2005-0183

ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument...

CVE-2002-1650

CVE-2002-1650 impacts SquirrelMail’s spell checker plugin (check_me.mod.php) in all releases before 1.2.3. The underlying issue is a flaw in handling the sqspell_command parameter, which allows remote attackers to execute arbitrary commands. The vulnerability enables remote code execution with ne...

CVE-2002-1648

CVE-2002-1648 describes a CSRF vulnerability in SquirrelMail’s compose.php prior to version 1.2.3. An attacker can trigger a request via an IMG URL with manipulated send_to and subject parameters to send mail as another user, exploiting cookie-based authentication. Affected software: SquirrelMail...

CVE-2002-1649

Cross-site scripting XSS vulnerability in readbody.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag...

CVE-2002-1648

Cross-site request forgery CSRF vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified sendto and subject parameters...

CVE-2002-1650

The spell checker plugin checkme.mod.php for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspellcommand parameter...

CVE-2002-1649

CVE-2002-1649 affects SquirrelMail prior to 1.2.3, in read_body.php. It is a Cross-site Scripting (XSS) flaw allowing remote attackers to execute arbitrary JavaScript via a javascript: URL in an IMG tag. No exploitation details are provided in the documents. Remediation: upgrade to SquirrelMail 1...

USN-99-2: Fixed php4 packages for USN-99-1

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...