BasiliX Webmail 1.1 - Message Content Script Injection

source: https://www.securityfocus.com/bid/5060/info BasiliX is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support. A script injection issue has been reported in BasiliX Webmail. Script commands are not filtered from the...

BasiliX Webmail 1.1 - Message Content Script Injection

BasiliX Webmail 1.1 - Message Content Script Injection source: https://www.securityfocus.com/bid/5060/info BasiliX is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support. A script injection issue has been reported in BasiliX...

NOCC 0.9.x - Webmail Script Injection

NOCC 0.9.x - Webmail Script Injection source: https://www.securityfocus.com/bid/4740/info NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages. A script injection issue has been reported with the way...

NOCC: cross-site-scripting bug

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following cross-site-scripting bug in NOCC: Details - ------- Product: NOCC Affected Version: 0.9.5 and maybe all versions before Immune Version: none, authors are working on it OS affected: all OS with php and mysql Vendor-URL:...

NOCC 0.9.x - Webmail Script Injection

source: https://www.securityfocus.com/bid/4740/info NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages. A script injection issue has been reported with the way emails are displayed to users of NOCC...

CVE-2001-1294

Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service crash in the Webmail interface via a long username and password...

CVE-2001-1283

CVE-2001-1283 affects Ipswitch IMail webmail interface (versions 7.04 and earlier). Affected component is the webmail CGI handlers (readmail.cgi and printmail.cgi); remote authenticated users can crash the service via mailbox names containing many dots or other characters, likely due to a buffer ...

CVE-2001-1294

CVE-2001-1294 describes a buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier, allowing remote attackers to cause a denial of service (crash) in the Webmail interface via a long username and password. The connected records confirm the affected software and the impact (availability). Root ca...

CVE-2001-1283

The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service crash via a mailbox name that contains a large number of . dot or other characters to programs such as 1 readmail.cgi or 2 printmail.cgi, possibly due to a buffer overflow that...

emumail.cgi

name : emumail.cgi date : 04/04/2002 description : EMU Webmail: how to check your email from the web. severity : Low/average-risk homepage : www.emumail.com Any user can view files on the remote system: xxx/PATH/emumail.cgi?type=FILE00 The vendor were contact about that...

SquirrelMail 1.2.x - Theme Remote Command Execution

source: https://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system. A vulnerability has been reporte...

SquirrelMail 1.2.x - Theme Remote Command Execution

SquirrelMail 1.2.x - Theme Remote Command Execution source: https://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality throu...

CVE-2001-0857

CVE-2001-0857 applies to Imp Webmail prior to version 2.2.7, where status.php3 is vulnerable to a cross-site scripting (XSS) flaw via the message parameter that can enable session hijacking. The connected Nessus plugin notes that IMP

CVE-2001-0857

Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message parameter...

CVE-2001-1045

Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files via a .. dot dot in the requestidDUMMY parameter...

CVE-2001-1044

CVE-2001-1044 affects Basilix Webmail 0.9.7beta (and possibly other versions). The issue is that ".class" and ".inc" files are stored under the document root without access restrictions, enabling remote attackers to read sensitive information such as MySQL passwords and usernames from the mysql.c...

CVE-2001-1045

CVE-2001-1045 describes a directory traversal vulnerability in Basilix Webmail up to version 1.0.3beta, where an attacker can read arbitrary files by injecting a .. (dot dot) into the request_id[DUMMY] parameter of basilix.php3. The connected documents corroborate that the vulnerability allows re...

CVE-2001-0953

Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is installed under the web document root...

CVE-2001-1044

Basilix Webmail 0.9.7beta, and possibly other versions, stores .class and .inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file...

CVE-2001-0953

CVE-2001-0953 affects Kebi WebMail. The vulnerability lets remote attackers access the administrator menu and gain privileges via the /a/ hidden directory located under the web document root. The issue is described as a remote privilege escalation with complete confidentiality, integrity, and ava...