EUVD-2006-3560

Malware in sbrugna...

CVE-2006-3564

Multiple cross-site scripting XSS vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the email, 2 cond, or 3 name parameters to a addressbook.view.php, 4 the daysprune parameter to b index.php, 5 the datato parameter to c...

CVE-2006-3564

HiveMail 1.3 and earlier are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue arises from unsanitized input in several parameters across PHP scripts: (1) email, (2) cond, or (3) name in addressbook.view.php; (4) daysprune in index.php; (5) data[to] in compose.email.php; ...

CVE-2006-3565

The CVE-2006-3565 entry describes an SQL injection in HiveMail (version 1.3 and earlier) that affects search.results.php via the fields[] parameter, allowing a remote attacker to execute arbitrary SQL commands. The vulnerability is categorized with a high base score (7.5, CVSSv2: AV:N/AC:L/Au:N/C...

HiveMail 1.3 - addressbook.add.php Remote Code Execution

HiveMail 1.3 - addressbook.add.php Remote Code Execution !/usr/bin/perl HiveMail = 1.3 remote command execution exploit Advisory: http://www.gulftech.org/?node=research&articleid=00098-02102006 To get the hivesession: log on hivemail with firefox then look at the hivesession number in the url. ye...

Sql injection

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0757

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0759

Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...