security flaw

SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abookdatabase.php...

CVE-2004-0524

The CVE-2004-0524 entry describes a buffer overflow in the chpasswd command of the Change_passwd plugin (before 4.0) used by SquirrelMail. The vulnerability allows local users to gain root privileges through a long user name. The NVD entry assigns a base score of 10.0 (HIGH) with local, low-compl...

CVE-2004-0520

CVE-2004-0520 is a cross-site scripting (XSS) vulnerability in mime.php of SquirrelMail prior to 1.4.3. The issue allows remote attackers to inject arbitrary HTML and script via the content-type mail header, demonstrated via read_body.php. The vulnerability affects the webmail client, with an att...

CVE-2004-0521

CVE-2004-0521 affects SquirrelMail prior to version 1.4.3 RC1 through an SQL injection in abook_database.php. Root cause: improper input handling allows remote attackers to execute arbitrary SQL statements. Impact (per sources): confidentiality, integrity, and availability may be fully compromise...

CVE-2004-0520

Cross-site scripting XSS vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using readbody.php...

CVE-2004-0519

SquirrelMail 1.4.x is affected by multiple cross-site scripting (XSS) vulnerabilities (e.g., via the mailbox parameter in compose.php) that could let remote attackers run arbitrary JavaScript in a user's browser and potentially steal authentication information. The issue concerns SquirrelMail ver...

CVE-2004-0519

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php...

CVE-2004-0521

SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abookdatabase.php...

SquirrelMail 1.2.x - From Email Header HTML Injection

source: https://www.securityfocus.com/bid/10450/info SquirrelMail is reported to be prone to a 'from' field email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to...

SquirrelMail 1.x - Email Header HTML Injection

source: https://www.securityfocus.com/bid/10439/info SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain access t...

SquirrelMail "Content-Type" XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================== - RS-Labs Security Advisory - =============================== Tittle: SquirrelMail "Content-Type" XSS vulnerability ID: RS-2004-1 Severity: Medium / High - Arbitrary tags injection in victim's browser context Date:...

[Full-Disclosure] RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I discovered a new XSS vuln in SquirrelMail which is quite dangerous since it could be exploited simply by sending a specially crafted mail to the victim. The victim only has to read the email in order to trigger the exploit. This bug is presen...

SquirrelMail 1.x - Email Header HTML Injection

SquirrelMail 1.x - Email Header HTML Injection source: https://www.securityfocus.com/bid/10439/info SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An...

"Content-Type" XSS vulnerability affecting other webmail systems

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results...

Multiple XSS Vulnerabilities in SquirrelMail

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description Several unspecified cross-site scripting XSS vulnerabilities and a well hidden SQL injection vulnerability were found. An XSS attack allows an...

[ GLSA 200405-16 ] Multiple XSS Vulnerabilities in SquirrelMail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200405-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

Multiple SquirrelMail bugs

Scrossite scripting, SQL injection...

SquirrelMail < 1.4.3 Multiple Vulnerabilities

The remote host is running SquirrelMail, a web-based mail server. There are several flaws in all versions less than 1.4.3 and development versions 1.5.0 and 1.5.1 that allow for local root access and remote cross-site scripting XSS attacks. Nessus has determined the vulnerability exists on the...

squirrel142.txt

SquirrelMail latest version although is tested on version 1.4.2 is prone to many cross scripting attacks that can be used to steal user cookies.The Exploit lies in the way squirrel mail represents the folder names and shows them.To make the matters worse.No extra unique variable added to the url...

SquirrelMail 1.4.x - Folder Name Cross-Site Scripting

SquirrelMail 1.4.x - Folder Name Cross-Site Scripting source: https://www.securityfocus.com/bid/10246/info It has been reported that SquirrelMail is affected by a cross-site scripting vulnerability in the handling of folder name displays. This issue is due to a failure of the application to...