[SECURITY] [DLA 1344-1] squirrelmail security update

Package : squirrelmail Version : 2:1.4.23svn20120406-2+deb7u2 CVE ID : CVE-2018-8741 Debian Bug : 893202 Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrar...

Roundcube Webmail 1.2.0 - 1.3.5 MX Injection Vulnerability

Roundcube Webmail is prone to an injection vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

[SECURITY] [DSA 4168-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4168-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2018 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4168-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

iRedMail Information Disclosure Vulnerability

iRedMail is an open source e-mail server solution . Roundcube Webmail is one of the browser-based mail client . A security vulnerability exists in Roundcube Webmail in previous versions of iRedMail commit f04b8ef. A remote attacker could exploit the vulnerability by sending a specially crafted...

webmail.task.com.br XSS vulnerability

Open Bug Bounty ID: OBB-581098 Description| Value ---|--- Affected Website:| webmail.task.com.br Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

Design/Logic Flaw

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

CVE-2018-1000072 affects iRedMail prior to commit f04b8ef, where the Roundcube Webmail component contains an insecure permissions flaw that can lead to exfiltration of sensitive data, including a user’s secret GPG key and other configuration files, via network access. The issue is documented acro...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2012-3536

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was...

CVE-2012-3536

Two XSS vulnerabilities were fixed in Hupa Webmail (Apache James project) affecting the message list and message view. An attacker could exploit by sending a crafted email that triggers XSS when opened or when the message list is viewed. The issue is reported as addressed in Hupa 0.0.3. No exploi...

CVE-2012-3536

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was...

fwbox.fastwebnet.it Open Redirect vulnerability

Open Bug Bounty ID: OBB-561545 Description| Value ---|--- Affected Website:| fwbox.fastwebnet.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Debian: Security Advisory (DLA-941-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Web Panel v0.9.8.12 - Persistent Vulnerabilities

Document Title: =============== CentOS Web Panel v0.9.8.12 - Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1836 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5962 CVE-ID: ======= CVE-2018-5962 Release Date:...

cali.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-456814 Description| Value ---|--- Affected Website:| cali.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CommuniGate Pro WebMail Crystal, pronto and pronto4 component cross-site scripting vulnerability

CommuniGate Pro is a comprehensive Mail Transfer Agent MTA developed by CommuniGate, Inc. that supports multiple platforms.WebMail Crystal, pronto and pronto4 are among the components used in it. A cross-site scripting vulnerability exists in the WebMail Crystal, pronto and pronto4 components of...

[SECURITY] [DLA 1193-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u9 CVE ID : CVE-2017-16651 A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. CVE-2017-16651 An authenticated attacker can take advantage of this flaw to read roundcubes configuration fil...