SquirrelMail < 1.4.3 Multiple Vulnerabilities

Binary data 1217.prm...

CVE-2004-0519

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php...

CVE-2004-0521

SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abookdatabase.php...

CVE-2004-0520

Cross-site scripting XSS vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using readbody.php...

SquirrelMail < 1.4.18 Multiple Vulnerabilities

Binary data 5037.prm...

CVE-2004-0524

Buffer overflow in the chpasswd command in the Changepasswd plugin before 4.0, as used in SquirrelMail, allows local users to gain root privileges via a long user name...

CVE-2004-0639

Multiple cross-site scripting XSS vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via 1 the $mailer variable in readbody.php, 2 the $senderNamespart variable in mailboxdisplay.php, and possibly other vectors including 3 the $eventtitle...

SquirrelMail < 1.2.11 Multiple Script XSS

The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive. Such versions do not properly sanitize From headers, leaving users vulnerable to XSS attacks. Further, since SquirrelMail displays From headers when listing a folder, attacks do...

[SECURITY] [DSA 535-1] New squirrelmail packages fix multiple vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 535-1 [email protected] http://www.debian.org/security/ Matt Zimmerman August 2nd, 2004 http://www.debian.org/security/faq -...

DSA-535 squirrelmail - several vulnerabilities

Bulletin has no description...

Fedora Core 1 : squirrelmail-1.4.3-0.f1.1 (2004-159)

A SQL injection flaw was found in SquirrelMail version 1.4.2 and earlier. If SquirrelMail is configured to store user addressbooks in the database, a remote attacker could use this flaw to execute arbitrary SQL statements. The Common Vulnerabilities and Exposures project has assigned the name...

Fedora Core 2 : squirrelmail-1.4.3-1 (2004-160)

A SQL injection flaw was found in SquirrelMail version 1.4.2 and earlier. If SquirrelMail is configured to store user addressbooks in the database, a remote attacker could use this flaw to execute arbitrary SQL statements. The Common Vulnerabilities and Exposures project has assigned the name...

SquirrelMail Detection

The remote host is running SquirrelMail, a PHP-based webmail package that provides access to mail accounts via POP3 or IMAP. This script was written by George A. Theall, . See the Nessus Scripts License for details. Changes by Tenable - Updated to use compat.inc 11/20/2009 include"compat.inc"; if...

CVE-2004-0639

Multiple cross-site scripting XSS vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via 1 the $mailer variable in readbody.php, 2 the $senderNamespart variable in mailboxdisplay.php, and possibly other vectors including 3 the $eventtitle...

CVE-2004-0639

CVE-2004-0639 affects SquirrelMail 1.2.0–1.2.10 (and earlier) with multiple XSS vectors in read_body.php and mailbox_display.php (also via event_title/event_text variables). Debian/DSA-535 notes four vulnerabilities including CVE-2004-0639; Debian fixes in 1.2.6-1.4 for Woody and 2:1.4.3a-0.1 for...

RHEL 3 : squirrelmail (RHSA-2004:240)

An updated SquirrelMail package that fixes several security vulnerabilities is now available. SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities have been found which affect the version of SquirrelMail shipped with Red Hat Enterprise Linux 3. A SQL injection flaw was found...

Squirrelmail: Another XSS vulnerability

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description A new cross-site scripting XSS vulnerability in Squirrelmail-1.4.3rc1 has been discovered. In functions/mime.php Squirrelmail fails to properly...

Important: Red Hat Security Advisory: squirrelmail security update

An updated SquirrelMail package that fixes several security vulnerabilities is now available. SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities have been found which affect the version of SquirrelMail shipped with Red Hat Enterprise Linux 3. An SQL injection flaw was foun...

security flaw

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php...

security flaw

SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abookdatabase.php...