1281 matches found
Cross site scripting
The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute...
CVE-2018-14950
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "a xlink:href=" attack...
Code injection
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "form action='data:text" attack...
CVE-2018-14951
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "form action='data:text" attack...
CVE-2018-14955
The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations animate to attribute...
CVE-2018-14952
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "maction xlink:href=" attack...
CVE-2018-14952
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "maction xlink:href=" attack...
UBUNTU-CVE-2018-14953
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "math xlink:href=" attack...
Design/Logic Flaw
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "a xlink:href=" attack...
UBUNTU-CVE-2018-14954
The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute...
UBUNTU-CVE-2018-14952
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "maction xlink:href=" attack...
UBUNTU-CVE-2018-14950
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "a xlink:href=" attack...
UBUNTU-CVE-2018-14951
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "form action='data:text" attack...
CVE-2018-14952
CVE-2018-14952 affects SquirrelMail up to 1.4.22 with XSS via crafted HTML payloads on the mail display page (e.g., ). Debian’s DLA-1484-1 notes fixed package squirrelmail 2:1.4.23~svn20120406-2+deb8u3 for Jessie, indicating remediation via upgrade. The connected Nessus/OpenVAS entries confirm un...
CVE-2018-14954
The CVE-2018-14954 issue concerns SquirrelMail up to version 1.4.22, where Cross‑Site Scripting (XSS) is possible via the formaction attribute on the mail message display page. Public disclosures in Debian indicate this is among several XSS flaws affecting SquirrelMail and note a fix in Debian 8:...
CVE-2018-14950
The CVE-2018-14950 entry applies to SquirrelMail up to version 1.4.22, where the mail message display page is vulnerable to XSS via an SVG attack (). The issue is a client‑side security flaw in how HTML/SVG content is rendered within the mail display view, enabling script execution in the applica...
CVE-2018-14951
CVE-2018-14951 affects SquirrelMail up to version 1.4.22, where a stored XSS is possible in the mail display page via a crafted form action using a data:text payload. Public disclosures and Debian security advisory confirm the issue and list affected packages; Debian fixes indicate upgrade to squ...
CVE-2018-14955
CVE-2018-14955 affects SquirrelMail prior to 1.4.23; the mail display page (through 1.4.22) is vulnerable to XSS via SVG animations (animate to attribute). Debian reports a fixed package at squirrelmail 2:1.4.23~svn20120406-2+deb8u3; other disclosures note unpatched status in some distros (e.g., ...
