FreeBSD : squirrelmail -- XSS vulnerability (d1ce8a4f-c235-11dd-8cbc-00163e000016)

Squirrelmail team reports : An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting XSS when the user viewed the message in SquirrelMail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

SquirrelMail畸形邮件消息HTML注入漏洞

BUGTRAQ ID: 32603 CVECAN ID: CVE-2008-2379 SquirrelMail是一个多功能的用PHP4实现的Webmail程序，可运行于Linux/Unix类操作系统下。 SquirrelMail没有正确地过滤邮件消息的中的HTML部分输入便显示给了用户。如果打开了恶意的邮件消息的话，就可能导致在用户浏览器会话中执行任意代码。成功攻击要求Options - Display Preferences中启用了Show HTML Version by Default选项。 SquirrelMail 1.4.16 SquirrelMail ------------...

squirrelmail -- Cross site scripting vulnerability

Squirrelmail team reports: An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting XSS when the user viewed the message in SquirrelMail...

openSUSE 10 Security Update : squirrelmail (squirrelmail-5792)

Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 The previous update for the problem above contained a typo which broke squirrelmail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE 10 Security Update : squirrelmail (squirrelmail-5778)

Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

Fedora 8 : squirrelmail-1.4.16-1.fc8 (2008-9071)

update to 1.4.16 fixes CVE-2008-3663 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

[SECURITY] Fedora 8 Update: squirrelmail-1.4.16-1.fc8

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Fedora 9 : squirrelmail-1.4.16-1.fc9 (2008-8559)

rebase to 1.4.16 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] Fedora 9 Update: squirrelmail-1.4.16-1.fc9

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

SquirrelMail不安全COOKE泄漏漏洞

BUGTRAQ ID: 31321 CVE ID：CVE-2008-3663 CNCVE ID：CNCVE-20083663 SquirrelMail是一款基于PHP的WEB邮件服务程序。 SquirrelMail不安全处理COOKIE数据，远程攻击者可以利用漏洞获得敏感信息，窃取COOKIE验证敏感条文，进行会话劫持攻击。 当配置WEB应用程序只使用SSL时如转向所有HTTP请求到HTTPS，用户可以不能通过嗅探来进行截获。 要因此变的更安全，需要设置会话COOKIE标有安全标记，否则如果目标用户浏览器在同一域上只进行单个HTTP请求，COOKIE会通过HTTP传送。...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

Design/Logic Flaw

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

CVE-2008-3663 summary (from provided docs): SquirrelMail prior to the patch release had a session cookie that was not marked Secure during HTTPS, potentially allowing cookie exposure to remote attackers via HTTP requests. The linked advisories reference SquirrelMail 1.4.15 and note that updates/p...

Gentoo Security Advisory GLSA 200411-25 (SquirrelMail)

The remote host is missing updates announced in advisory GLSA 200411-25. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200501-39 (SquirrelMail)

The remote host is missing updates announced in advisory GLSA 200501-39. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200603-09 (squirrelmail)

The remote host is missing updates announced in advisory GLSA 200603-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200506-19 (SquirrelMail)

The remote host is missing updates announced in advisory GLSA 200506-19. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200708-08 (squirrelmail)

The remote host is missing updates announced in advisory GLSA 200708-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...