SquirrelMail GPGP Encryption Plugin 2.02.1 - Multiple Remote Command Execution Vulnerabilities

SquirrelMail GPGP Encryption Plugin 2.02.1 - Multiple Remote Command Execution Vulnerabilities source: https://www.securityfocus.com/bid/24828/info Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow malicious webmail users to execute system commands remotely. These issues occur...

SquirrelMail G/PGP Encryption Plugin 2.0/2.1 - Multiple Remote Command Execution Vulnerabilities

source: https://www.securityfocus.com/bid/24828/info Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow malicious webmail users to execute system commands remotely. These issues occur because the application fails to sufficiently sanitize user-supplied data. Commands would run ...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3170

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3172

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

Directory traversal

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

Design/Logic Flaw

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3170

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3172

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

CVE-2007-3171

Affected software/impact: Uebimiau Webmail is vulnerable to information disclosure. The issue occurs in the demo/pop3/error.php script when an invalid value is supplied for the smarty or selected_theme parameter, which causes error messages to reveal the installation path. Root cause (as describe...

CVE-2007-3170

CVE-2007-3170 relates to multiple XSS vulnerabilities in UebiMiau Webmail. The affected component is the webmail PHP application, with two identified vectors: (1) PATH_INFO to redirect.php and (2) the selected_theme parameter to demo/pop3/error.php. The underlying issue is insufficient sanitizati...

CVE-2007-3172

CVE-2007-3172 relates to a directory traversal in UebiMiau Webmail via the demo/pop3/error.php (selected_theme parameter) that allows remote disclosure of directory existence. Connected sources describe a broader set of input-validation issues in UebiMiau’s error.php: similar traversal/file-discl...

madirish-rfi.txt

Madirish Webmail v2.0 Remote File Include Vulnerabilities Author : BoZKuRTSeRDaR Contact MSN:[email protected] My Homepage :WwW.Turkmilliyetcileri.OrG script Download : http://sourceforge.net/projects/madirishwebmail code: requireonce$GLOBALS'basedir'."lib/sql.php" exploit:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

CVE-2007-3058

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

CVE-2007-3058

CVE-2007-3058 affects Madirish Webmail 2.0 (lib/addressbook.php). The flaw is a PHP remote file inclusion via a URL in the GLOBALS[basedir] parameter, exploitable through multiple pages (calendar.php, compose.php, index.php). The description in the sources confirms a remote code execution vector,...

CVE-2007-3058

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

Madirish Webmail 2.0 (addressbook.php) Remote File Inclusion Vuln

No description provided by source. Madirish Webmail v2.0 Remote File Include Vulnerabilities Author : BoZKuRTSeRDaR Contact MSN:[email protected] My Homepage :WwW.Turkmilliyetcileri.OrG script Download : http://sourceforge.net/projects/madirishwebmail code:...