CVE-2012-0909

CVE-2012-0909 is an XSS in Horde_Form within Horde Groupware Webmail Edition prior to 4.0.6. Public records show fixes in Horde3 branch to 3.3.13 (openSUSE openSUSE-SU-2012:0286-1) and related security updates; remediation involves upgrading to Horde Groupware Webmail Edition 4.0.6 or newer, or H...

ME020567: MailEnable webmail cross-site scripting vulnerability CVE-2012-0389

ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact: 2012-01-04 09:49:36 UTC Vendor...

MailEnable Webmail Cross Site Scripting

ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact: 2012-01-04 09:49:36 UTC Vendor...

MailEnable Webmail - Cross-Site Scripting

ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact: 2012-01-04 09:49:36 UTC Vendor...

MailEnable Webmail - Cross-Site Scripting

MailEnable Webmail - Cross-Site Scripting ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor...

ATMAIL WebMail Admin 6.3.4 Cross Site Scripting

Title: ====== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities Date: ===== 2012-01-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=376 VL-ID: ===== 376 Introduction: ============= Atmail is a commercial Linux messaging platform provider. The company was founded...

ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities

Document Title: =============== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=376 Release Date: ============= 2012-01-07 Vulnerability Laboratory ID VL-ID: ==================================== 376...

ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities

Document Title: =============== ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=375 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 375...

ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities

Document Title: =============== ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=375 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 375...

NATO Research & Technologie - File Include Vulnerability

Document Title: =============== NATO Research & Technologie - File Include Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/318.wmv View: http://www.youtube.com/watch?v=7PfcQUMvNg8 Release Date: ============= 2011-11-07 Vulnerability Laboratory ID...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

UBUNTU-CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

Sql injection

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

DEBIAN-CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

CVE-2011-4078 affects Roundcube Webmail

Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection

Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. "POST" data in...