1281 matches found
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as a remote attacker could use this flaw to send a specially-crafted Multipurpose Internet Mail Extensions MIME message that, when opened by a victim, would lead to arbitrary web script execution in the context of...
Authorization Bypass
squirrelmail is vulnerable to authorization bypass. The vulnerability exists as an input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in...
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as a remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session...
Information Disclosure
squirrelmail is vulnerable to information disclosure. The vulnerability exists as a flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on...
Denial Of Service (DoS)
squirrelmail is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid....
Authorization Bypass
squirrelmail is vulnerable to authorization bypass. THe vulnerability exists as SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data...
Cross-site Request Forgery (CSRF)
SquirrelMail is vulnerable to cross-site request forgery CSRF. Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery CSRF attacks. If a remote attacker tricked a user into visiting a malicious web page, the attacker could hijack that user's authenticatio...
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as it was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets CSS directives used in HTML mail. A remote attacker could send a specially-crafted email that could place mail content above...
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page...
Arbitrary Code Execution
squirrelmail is vulnerable to arbitrary code execution. The vulnerability exists as a server-side code injection flaw was found in the SquirrelMail "mapypalias" function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service NIS server via the...
Information Disclosure
squirrelmail is vulnerable to information disclosure. It was discovered that SquirrelMail allowed cookies over insecure connections ie did not restrict cookies to HTTPS connections. An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to...
Cross-Site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting. Insufficient HTML mail sanitization allows a remote attacker to send a specially-crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or...
Session Hijacking
squirrelmail is vulnerable to session hijacking. The vulnerability exists as the Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory introduced a session handling flaw. Users who logged back into SquirrelMail without restarting their web browsers were assigned fixed session...
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could inject arbitrary Javascript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL...
Cross-Site Request Forgery (CSRF)
squirrelmail is vulnerable to cross-site request forgery. Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted...
Cross-site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail...
Arbitrary Code Execution
squirrelmail is vulnerable to arbitrary code execution. A local file disclosure flaw was found in the way SquirrelMail loads plugins. If registerglobals is on and magicquotesgpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web...
Dynamic Variable Evaluation
SquirrelMail is vulnerable to Dynamic variable evaluation. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users' preferences or attachments...
