Fedora Core 3 : squirrelmail-1.4.3a-6.FC3 (2004-472)

Fri Nov 19 2004 Warren Togami 1.4.3a-6.FC3 - FC3 - Fri Nov 19 2004 Warren Togami 1.4.3a-7 - CVE-2004-1036 Cross Site Scripting in encoded text - 112769 updated splash screens Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Fedora Core 2 : squirrelmail-1.4.3a-6.FC2 (2004-471)

Fri Nov 19 2004 Warren Togami 1.4.3a-6.FC2 - FC2 - Fri Nov 19 2004 Warren Togami 1.4.3a-7 - CVE-2004-1036 Cross Site Scripting in encoded text - 112769 updated splash screens - Thu Oct 14 2004 Warren Togami 1.4.3a-5 - defaultfolderprefix dovecot compatible by default...

FreeBSD : squirrelmail -- XSS (185)

The following package needs to be updated: ja-squirrelmail %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg7fbfe159343811d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyrig...

SquirrelMail: Encoded text XSS vulnerability

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description SquirrelMail fails to properly sanitize certain strings when decoding specially-crafted headers. Impact By enticing a user to read a...

GLSA-200411-25 : SquirrelMail: Encoded text XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200411-25 SquirrelMail: Encoded text XSS vulnerability SquirrelMail fails to properly sanitize certain strings when decoding specially crafted headers. Impact : By enticing a user to read a specially crafted e-mail, an attacker ca...

CVE-2004-1036

Cross-site scripting XSS vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML...

CVE-2004-1036

CVE-2004-1036 affects SquirrelMail prior to versions 1.4.3a and earlier, and 1.5.1-cvs before 23 Oct 2004. The vulnerability is a cross-site scripting (XSS) flaw in the decoding of encoded text in certain headers within mime.php, enabling remote attackers to run arbitrary web script or HTML in th...

SquirrelMail decodeHeader Arbitrary HTML Injection

The remote host is running SquirrelMail, a webmail system written in PHP. Versions of SquirrelMail prior to 1.4.4 are affected by an email HTML injection issue. A remote attacker can exploit this flaw to gain access to the users' accounts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SquirrelMail < 1.4.4 decodeHeader HTML Injection

Binary data 2401.prm...

squirrelmail -- cross site scripting vulnerability

A SquirrelMail Security Notice reports: There is a cross site scripting issue in the decoding of encoded text in certain headers. SquirrelMail correctly decodes the specially crafted header, but doesn't sanitize the decoded strings...

Debian DSA-191-1 : squirrelmail - XSS

Several cross site scripting vulnerabilities have been found in squirrelmail, a feature-rich webmail package written in PHP4. The Common Vulnerabilities and Exposures CVE project identified the following vulnerabilities : - CAN-2002-1131: User input is not always sanitized so execution of arbitra...

Debian DSA-535-1 : squirrelmail - several vulnerabilities

Four vulnerabilities were discovered in squirrelmail : - CAN-2004-0519 Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the...

Debian DSA-220-1 : squirrelmail - XSS

A cross site scripting vulnerability has been discovered in squirrelmail, a feature-rich webmail package written in PHP4. Squirrelmail doesn't sanitize user provided variables in all places, leaving it vulnerable to a cross site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, In...

CVE-2002-1132

SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script...

CVE-2002-1132

CVE-2002-1132 affects SquirrelMail 1.2.7 and earlier. A malformed optpage argument can cause an error message that reveals the absolute pathname of options.php, exposing information about the script. The issue is documented under CAN-2002-1131 and CAN-2002-1132; Debian advisories DSA-191-1/191-2 ...

GLSA-200406-08 : Squirrelmail: Another XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200406-08 Squirrelmail: Another XSS vulnerability A new cross-site scripting XSS vulnerability in Squirrelmail-1.4.3rc1 has been discovered. In functions/mime.php Squirrelmail fails to properly sanitize user input. Impact : By...

GLSA-200405-16 : Multiple XSS Vulnerabilities in SquirrelMail

The remote host is affected by the vulnerability described in GLSA-200405-16 Multiple XSS Vulnerabilities in SquirrelMail Several unspecified cross-site scripting XSS vulnerabilities and a well-hidden SQL injection vulnerability were found. An XSS attack allows an attacker to insert malicious cod...

SquirrelMail - chpasswd Local Privilege Escalation (Brute Force)

SquirrelMail - chpasswd Local Privilege Escalation Brute Force / PSTchpasswdexp-vb.c: Squirrelmail chpasswd local root bruteforce exploit Author: Bytes || www ph4nt0m net Notice: vb: Local bruteforce version vR: remote bruteforce version Greatze: ph4nt0m,music@0x557 All PST...

SquirrelMail (chpasswd) Local Root Bruteforce Exploit

Exploit for linux platform in category local exploits ===================================================== SquirrelMail chpasswd Local Root Bruteforce Exploit ===================================================== / PSTchpasswdexp-vb.c: Squirrelmail chpasswd local root bruteforce exploit Author:...

SquirrelMail - 'chpasswd' Local Privilege Escalation (Brute Force)

/ PSTchpasswdexp-vb.c: Squirrelmail chpasswd local root bruteforce exploit Author: Bytes || www ph4nt0m net Notice: vb: Local bruteforce version vR: remote bruteforce version Greatze: ph4nt0m,music@0x557 All PST member,Grip2,Airsupply,Jambalaya,Ann,Paul,Happy... Thax: My...