Open WebMail sessionid Parameter XSS

The installed version of Open WebMail on the remote host is prone to cross-site scripting attacks because it fails to sanitize user- supplied input to the 'sessionid' parameter of the 'openwebmail-main.pl' script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2004-2458

Open WebMail 2.30 and earlier is affected. When use_syshomedir is disabled or create_syshomedir is enabled, the application creates new directories before authentication, enabling a remote attacker to create arbitrary directories. This is a client/server vulnerability in Open WebMail’s directory ...

CVE-2004-2458

Open WebMail 2.30 and earlier, when usesyshomedir is disabled or createsyshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories...

CVE-2004-2334

Multiple cross-site scripting XSS vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via 1 a hex-encoded value to the variable parameter in emumail.fcgi, 2 the folder parameter in emumail.fcgi, or Javascript in the 3 username or 4 password field in...

CVE-2004-2334

CVE-2004-2334 affects EMU WebMail 5.2.7. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML through: (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.f...

CVE-2004-2385

EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information home directory via an HTTP request for init.emu...

CVE-2004-2385

Technical details about CVE-2004-2385 are not publicly provided in the connected documents. No specifics on affected products, versions, root cause, or remediation are present. Monitor for updates.

[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595-02 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2005:595 An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released wi...

Moderate: Red Hat Security Advisory: squirrelmail security update

An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released with this errata contained a bug which rendered the...

CVE-2005-2428

Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

atmailXSS.txt

@Mail multiple variable cross-site scripting vendor url:http://www.atmail.com Advisory:http://lostmon.blogspot.com/2005/07/ mail-multiple-variable-cross-site.html vendor notify:yes exploit available: yes @Mail is a feature rich Email solution that allows users to access email-resources via the we...

SquirrelMail Arbitrary Variable Overwriting Vulnerability

GulfTech Security Research July 14th, 2005 Vendor : The SquirrelMail Project Team URL : http://www.squirrelmail.org/ Version : SquirrelMail 1.4.5-RC1 && Earlier Risk : Variable Overwriting Description: SquirrelMail is a standards-based webmail package written in php. It includes built-in pure PHP...

CVE-2001-1537

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges...

CVE-2001-1537

The CVE concerns TWIG webmail versions 2.7.4 and earlier where the default 'basic' security setting in config.php stores cleartext usernames and passwords in cookies. This could allow an attacker to obtain authentication information and gain privileges. The PT-2001-2622 entry reiterates the affec...

[SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 756-1 [email protected] http://www.debian.org/security/ Martin Schulze July 13th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 756-1 [email protected] http://www.debian.org/security/ Martin Schulze July 13th, 2005 http://www.debian.org/security/faq -...