CVE-2003-0160

CVE-2003-0160 affects SquirrelMail before 1.2.11. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary HTML and steal information from a client’s web browser. The provided documents do not specify the root cause details or a r...

CVE-2003-0160

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser...

SquirrelMail 1.2.9 / 1.2.10 read_body.php Multiple Parameter XSS

The remote host seems to be vulnerable to a security problem in SquirrelMail. The 'readbody.php' script doesn't filter out user input for multiple parameters, allowing for XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was rewritten by Tenable Network Security, Inc....

VPOPMail for SquirrelMail vpopmail.php Arbitrary Command Execution

The remote host is running an old version of vpopmail.php an extension to squirrelmail which allows users to execute arbitrary commands on the remote host with the same privileges as the web server the user is running as. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 220-1] New squirrelmail packages fix cross site scripting problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 220-1 [email protected] http://www.debian.org/security/ Martin Schulze January 2nd, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 220-1] New squirrelmail packages fix cross site scripting problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 220-1 [email protected] http://www.debian.org/security/ Martin Schulze January 2nd, 2003 http://www.debian.org/security/faq -...

DSA-220 squirrelmail - cross site scripting

Bulletin has no description...

CVE-2002-2086

Multiple cross-site scripting XSS vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via 1 "script" in unspecified input fields or 2 a javascript: URL in the src attribute of an IMG tag...

CVE-2002-1649

Cross-site scripting XSS vulnerability in readbody.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag...

CVE-2002-1648

Cross-site request forgery CSRF vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified sendto and subject parameters...

CVE-2002-1650

The spell checker plugin checkme.mod.php for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspellcommand parameter...

CVE-2002-1341

Cross-site scripting XSS vulnerability in readbody.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the 1 mailbox and 2 passedid parameters...

CVE-2002-1341

CVE-2002-1341 affects SquirrelMail 1.2.9/1.2.10 and earlier, with an XSS flaw in read_body.php that allows remote attackers to inject script/HTML via mailbox and passed_id parameters. Connected advisories confirm this is a cross-site scripting issue (CVSS v2 base 6.8; vector AV:N/AC:M/Au:N/C:P/I:...

CVE-2002-1341

Cross-site scripting XSS vulnerability in readbody.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the 1 mailbox and 2 passedid parameters...

squirellmail php bugs

Uninitialized PHP valirables, crossite scripting...

SquirrelMail v1.2.9 XSS bugs

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: SquirrelMail v1.2.9 XSS bugs product: SquirrelMail v1.2.9 vendor: www.squirrelmail.org risk: low date: 12/3/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory url: http://f0kp.iplus.ru/bz/008.txt...

CVE-2002-1276

An incomplete fix for a cross-site scripting XSS vulnerability in SquirrelMail 1.2.8 calls the striptags function on the PHPSELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks...

CVE-2002-1276

An incomplete fix for a cross-site scripting XSS vulnerability in SquirrelMail 1.2.8 calls the striptags function on the PHPSELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks...

CVE-2002-1276

CVE-2002-1276 concerns SquirrelMail XSS due to an incomplete fix in version 1.2.8 where strip_tags is applied to PHP_SELF but not saved back, leaving room for injection. OpenVAS notes the read_body.php path (SquirrelMail 1.2.9/1.2.10) as vulnerable to multiple parameter XSS. Debian security advis...

[SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-2 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...