4295 matches found
Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
Exploit for unknown platform in category remote exploits ============================================================== Lotus Domino Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attacke...
Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stor...
Lotus Domino R6 Webmail - Remote Password Hash Dumper
!/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields,...
uebimiau-xss.txt
Uebimiau index.php Cross-Site Scripting Vulnerability Uebimiau is an universal webmail developed in PHP. This issue is due to a failure in the application to properly sanitize user-supplied input. Attackers may exploit this issue via a web client. An attacker may leverage this issue to have...
squirrelmail security update
CentOS Errata and Security Advisory CESA-2007:0022 A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An...
Moderate: Red Hat Security Advisory: squirrelmail security update
A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary Javascript or HTML...
CVE-2007-0579
Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors. NOTE: some of these details are obtained from third party information...
CVE-2007-0579
CVE-2007-0579 affects Horde Groupware Webmail Edition before 1.0 and Groupware before 1.0. Unspecified vulnerability in the calendar component allows remote attackers to include certain files via unspecified vectors. No further technical details or remediation are provided in the accessible docum...
[NETRAGARD-20061218 SECURITY ADVISORY] [@Mail WebMail Cross Site Request Forgery]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Netragard, L.L.C Advisory ATMAIL-XRRF-ADVISORY-20061218 Strategic Reconnaissance Team ------------------------------------------------ http://www.netragard.com -- "We make I.T. Safe." POSTING NOTICE -...
[SECURITY] Fedora Core 6 Update: squirrelmail-1.4.8-3.fc6
SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...
[SECURITY] Fedora Core 5 Update: squirrelmail-1.4.8-3.fc5
SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...
Debian DSA-1241-1 : squirrelmail - XSS
Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and deletedraft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user's webmail...
[SECURITY] [DSA 1241-1] New squirrelmail packages fix cross-site scripting
-------------------------------------------------------------------------- Debian Security Advisory DSA 1241-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 25th, 2006 http://www.debian.org/security/faq -...
DSA-1241-1 squirrelmail
Bulletin has no description...
CVE-2006-6701
Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...
CVE-2006-6700
Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...
CVE-2006-6700
Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...
CVE-2006-6701
Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...
CVE-2006-6700
Technical details about CVE-2006-6700 are not publicly available in the provided documents. The description notes a vague initial disclosure. Monitor for updates from the sources to obtain affected products, impact, and remediation information.
CVE-2006-6701
CVE-2006-6701 affects Atmail WebMail: CSRF in util.pl (4.51) and util.php (5.x before 5.03) enables remote manipulation of settings as another user via a crafted HTML email (SRC in IMG). Mitigation: upgrade to 5.0.3 (or later) or apply vendor patches as described in connected advisories.