eGroupWare_infoleak.txt

MasterMind Security Group, Inc. Security Brief Date: April 7, 2005 Contact: Gerald Quakenbush Severity: Moderate to Serious Product: Confirmed in eGroupWare 1.001 and 1.006 Synopsis ======== The eGroupWare open-source software www.egroupware.org has a flaw that could expose confidential...

CVE-2005-1129: Undefined Security Weakness

eGroupWare 1.0.6 and earlier, when an e-mail is composed with an attachment but not sent, will send that attachment in the next e-mail, which may cause sensitive information to be sent to the wrong recipient...

IlohaMail read_message.php Attachment Multiple Field XSS

Based on its version number, the installation of IlohaMail on the remote host does not properly sanitize attachment file names, MIME media types, and HTML / text email messages. An attacker can exploit these vulnerabilities by sending a specially crafted message to a user which, when read using a...

eGroupWare Leaks Files

MasterMind Security Group, Inc. Security Brief Date: April 7, 2005 Contact: Gerald Quakenbush geraldq AT mastermindsecuritygroup.com Severity: Moderate to Serious Product: Confirmed in eGroupWare 1.001 and 1.006 Synopsis ======== The eGroupWare open-source software www.egroupware.org has a flaw...

EGroupWare < 1.0.0.007 Attachment Information Disclosure

Binary data 2819.prm...

[SIG^2 G-TEC] SurgeMail Webmail Attachment Upload and XSS Vulnerabilities

SIG^2 Vulnerability Research Advisory SurgeMail Webmail Attachment Upload and XSS Vulnerabilities by Tan Chew Keong Release Date: 23 Mar 2005 ADVISORY URL http://www.security.org.sg/vuln/surgemail22g3.html SUMMARY SurgeMail http://netwinsite.com/surgemail/ is a next generation Mail Server -...

surgemail22g3.txt

SIG^2 Vulnerability Research Advisory SurgeMail Webmail Attachment Upload and XSS Vulnerabilities by Tan Chew Keong Release Date: 23 Mar 2005 ADVISORY URL http://www.security.org.sg/vuln/surgemail22g3.html SUMMARY SurgeMail http://netwinsite.com/surgemail/ is a next generation Mail Server -...

CVE-2005-0783

Cross-site scripting XSS vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file...

CVE-2005-0806

Evolution 2.0.3 allows remote attackers to cause a denial of service application crash or hang via crafted messages, possibly involving charsets in attachment filenames...

CVE-2005-0806

Evolution 2.0.3 allows remote attackers to cause a denial of service application crash or hang via crafted messages, possibly involving charsets in attachment filenames...

CVE-2005-0806: Undefined Security Weakness

Evolution 2.0.3 allows remote attackers to cause a denial of service application crash or hang via crafted messages, possibly involving charsets in attachment filenames...

[Full-disclosure] 3 XSS Vulnerabilities in Phorum &lt;= 5.0.14

Author: Jon Oberheide [email protected] Date: Sat, March 12th, 2005 Summary ======= Application: Phorum Vendor Website: http://www.phorum.org Affected Versions: = 5.0.14 Type of Vulnerability: Cross Site Scripting XSS About Phorum ============ Phorum is a web based message board written in PHP...

[Full-Disclosure] Novell/Ximian Evolution multiple text attachments DoS

================== =====Analysis===== ================== I just wanted to inform users of Ximian Evolution 2.0 software that there exists a way to temporarily DoS the local application and/or machine by attaching an absurd amount of .ezm files to a normal email. It seems that Evolution tries to...

CVE-2004-1672: Undefined Security Weakness

attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request...

CVE-2004-1607: Undefined Security Weakness

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a 1 Library or 2 Attachment request with an invalid file parameter, which reveals the path in an error message...

CVE-2004-1404

Attachment Mod 2.3.10 module for phpBB, when used with Apache modmime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code...

CVE-2004-1404

The CVE-2004-1404 entry concerns the Attachment Mod 2.3.10 module for phpBB when used with Apache mod_mime. The vulnerability arises from improper handling of files with double extensions (e.g., .php.rar), which can enable remote attackers to upload and execute arbitrary code on the server. The p...

CVE-2004-1399

The CVE-2004-1399 entry concerns the phpBB Attachment module (version 2.3.10 and earlier). The underlying issue is a directory traversal vulnerability where an attacker can cause a filename to include .. to read arbitrary files. Impact is described as partial confidentiality (read access) with no...

CVE-2004-1399: Undefined Security Weakness

Directory traversal vulnerability in the Attachment module 2.3.10 and earlier for phpBB allows remote attackers to read arbitrary files via a .. dot dot in the filename...

CVE-2004-1404: Undefined Security Weakness

Attachment Mod 2.3.10 module for phpBB, when used with Apache modmime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code...