CVE-2002-1004

CVE-2002-1004 concerns ArGoSoft Mail Server Plus/Pro WebMail (≤1.8.1.5). The vulnerability is a directory traversal in the WebMail interface that allows remote attackers to read arbitrary files via …/ sequence in a URL. Affected: ArGoSoft Mail Server WebMail feature (versions up to 1.8.1.5 and ea...

CVE-2002-0532

EMU Webmail contains a vulnerability (CVE-2002-0532) where a malicious dot-dot in the HTTP Host header can point to a Trojan horse configuration file with a pageroot specifier containing shell metacharacters, allowing local users to execute arbitrary programs. Root cause is improper Host header h...

CVE-2002-0532

EMU Webmail allows local users to execute arbitrary programs via a .. dot dot in the HTTP Host header that points to a Trojan horse configuration file that contains a pageroot specifier that contains shell metacharacters...

CVE-2002-1527

emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing script, which generates a regular expression matching error that includes the pathname in the resulting error message...

CVE-2002-0531

EMU Webmail vulnerability: directory traversal in emumail.cgi affects 4.5.x and 5.1.0, allowing read/list of arbitrary files via .. in the type parameter. Root cause is path traversal in the type parameter; exploitation details and remediation are not provided in the supplied documents.

CVE-2002-0531

Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbitrary directories via a .. dot dot in the type parameter...

CVE-2002-1526

Cross-site scripting XSS vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via the email address field...

CVE-2002-1527

The CVE-2002-1527 entry concerns EMU Webmail 5.0’s emumail.cgi. A remote attacker can determine the full pathname for emumail.cgi by sending a malformed string containing script, which triggers a regular expression matching error that exposes the pathname in the resulting error message. Affected ...

CVE-2002-1526

Cross-site scripting XSS vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via the email address field...

CVE-2002-1527

emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing script, which generates a regular expression matching error that includes the pathname in the resulting error message...

CVE-2002-1526

The CVE-2002-1526 entry describes a Cross-site scripting (XSS) vulnerability in EMU Webmail 5.0, specifically in the emumail.cgi handler. The underlying issue allows an attacker to inject arbitrary HTML or script via the email address field, enabling remote exploitation against affected deploymen...

Outblaze Webmail - Cookie Authentication Bypass

Outblaze Webmail - Cookie Authentication Bypass // source: https://www.securityfocus.com/bid/7115/info Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability. This issue may allow a malicious attacker to bypass the cookie-based authentication mechanis...

Outblaze Webmail - Cookie Authentication Bypass

// source: https://www.securityfocus.com/bid/7115/info Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability. This issue may allow a malicious attacker to bypass the cookie-based authentication mechanisms used by the affected Outblaze web mail server...

php-nuke again ...

-----BEGIN PGP SIGNED MESSAGE----- I. BACKGROUND PHP-Nuke is a popular Web portal system. Project homepage : http://www.phpnuke.org II. DESCRIPTION Remote attacker could transfer to server his own file or copy arbitrary file from system to accessible directory. The result of such acts could be...

CVE-2002-2165

The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox...

CVE-2002-2410

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information...

CVE-2002-1708

Cross-site scripting vulnerability XSS in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the 1 subject or 2 message fields...

CVE-2002-1710

The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file...

CVE-2002-1709

SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable...

CVE-2002-1385

openwebmailinit in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. dot dot sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be...