CVE-2008-1284

CVE-2008-1284 affects Horde 3.1.6, Groupware up to 1.0.5, and Groupware Webmail Edition up to 1.0.6. The vulnerability is a directory traversal via ../ and a null byte in the theme name, allowing remote authenticated users to read and execute arbitrary files. The NVD entry lists a CVSSv2 base sco...

Horde Webmail file inclusion proof of concept & patch.

Horde 3.1.6 arbitrary file inclusion vulnerability, proof of concept & patch. A severe security vulnerability affects any unix distribution running version 3.1.6 of the Horde webmail client included in most popular webhosting control panels. All previous versions are also affected and it is...

[SECURITY] Fedora 8 Update: imp-4.1.6-1.fc8

IMP is the Internet Messaging Program, one of the Horde applications. It provides webmail access to IMAP and POP3 accounts. The Horde Project writes web applications in PHP and releases them under Open Source licenses. For more information including help with IMP please visit http://www.horde.org...

[SECURITY] Fedora 7 Update: imp-4.1.6-1.fc7

IMP is the Internet Messaging Program, one of the Horde applications. It provides webmail access to IMAP and POP3 accounts. The Horde Project writes web applications in PHP and releases them under Open Source licenses. For more information including help with IMP please visit http://www.horde.org...

[SECURITY] Fedora 7 Update: turba-2.1.7-1.fc7

Turba is the Horde contact management application, which allows access to and storage of personal contacts including name, email address, phone number, and other easily customizable fields. Turba integrates with IMP Horde's webmail application as its address book. The Horde Project writes web...

Format string

Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via format string specifiers in the page parameter...

CVE-2008-1054

Stack-based buffer overflow in the libspawnusergetpid function in 1 swatch.exe and 2 surgemail.exe in NetWin SurgeMail 38k4 and earlier, and beta 39a, allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via an HTTP request with multiple long heade...

CVE-2008-1055

CVE-2008-1055 describes a format string vulnerability in NetWin SurgeMail’s webmail.exe components (versions 38k4 and earlier; beta 39a) and WebMail 3.1s and earlier. The flaw, triggered via the page parameter, can cause a denial of service (daemon crash) and may allow arbitrary code execution by...

CVE-2008-1054

NetWin SurgeMail 38k4 and earlier (including swatch.exe and surgemail.exe; webmail.exe and unspecified CGI executables) are affected by a stack-based buffer overflow in the _lib_spawn_user_getpid function. The overflow is triggered by an HTTP request with multiple long headers, causing an overflo...

Format string and buffer-overflow in SurgeMail 38k4

Luigi Auriemma Application: SurgeMail Mail Server http://netwinsite.com/surgemail/ Netwin's WebMail http://netwinsite.com/webmail/ Versions: SurgeMail = 38k4 and beta 39a Netwin's WebMail = 3.1s only bug A Platforms: Windows, Linux, FreeBSD, MacOSX and Solaris Bugs: A format string in webmail.exe...

SurgeMail CGI可执行程序远程溢出漏洞

BUGTRAQ ID: 27992 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail中用于处理CGI可执行程序的函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。...

SurgeMail Page命令远程格式串处理漏洞

BUGTRAQ ID: 27990 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail中用于处理webmail接口（webmail.exe）的CGI存在安全漏洞，远程攻击者可能利用此漏洞控制服务器。 CGI中用于在请求错误页面时构建错误消息的函数未经验证格式参数便直接将其传送给了lvprintf： "TPL: Failed to Locate Template c:\surgemail\webmail\panel%s%s%s%s%s%s.tpl2=No suc...

Surgemail and WebMail 3.0 - Page Remote Format String

Surgemail and WebMail 3.0 - Page Remote Format String source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier...

Surgemail and WebMail 3.0 - 'Page' Remote Format String

source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. A remote...

SmarterMail Enterprise 4.3 - malformed mail XSS

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbo...

CVE-2008-0807

lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...

MailBee WebMail Pro 'download_view_attachment.aspx'本地文件包含漏洞

MailBee WebMail Pro是一款基于ASPX的WEB应用程序。 MailBee WebMail Pro不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'downloadviewattachment.aspx'脚本对用户提交的'tempfilename'参数处理缺少充分过滤，提交多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容. AfterLogic MailBee WebMail Pro 厂商解决方案 目前没有解决方案提供： http://www.afterlogic.com/...

Directory traversal

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...