516 matches found
CVE-2006-4952
The CVE-2006-4952 entry concerns Neon WebMail for Java (pre-5.08) where the updatemail servlet allows remote attackers to move e-mail messages of arbitrary users between folders. The vulnerability is triggered via the ID parameter alongside folderid and tofolderid, enabling unauthorized relocatio...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4953
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the 1 adrsortkey and 2 adrsortkeydesc parameters in the a addrlist servlet, and the 3 sortkey and 4 sortkeydesc parameters in the b maillist servlet...
CVE-2006-4954
The CVE relates to the updateuser servlet in Neon WebMail for Java prior to 5.08, which does not validate the in_id parameter. This vulnerability allows remote attackers to modify information of arbitrary users (e.g., passwords, permissions, profile settings, and creating/deleting users). The iss...
CVE-2006-4953
Neon WebMail for Java before 5.08 is affected by multiple SQL injection vulnerabilities. The issues enable remote attackers to execute arbitrary SQL commands via parameters in two servlets: (1) addrlist (adr_sortkey and adr_sortkey_desc) and (2) maillist (sortkey and sortkey_desc). Root cause is ...
CVE-2006-4952
The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter...
NeoSys Neon Webmail for Java 5.065.07 - updatemail Servlet Arbitrary Mail Message Manipulation
NeoSys Neon Webmail for Java 5.065.07 - updatemail Servlet Arbitrary Mail Message Manipulation...
NeoSys Neon Webmail for Java 5.065.07 - addrlist Servlet Multiple SQL Injections
NeoSys Neon Webmail for Java 5.065.07 - addrlist Servlet Multiple SQL Injections...
[Full-disclosure] [vuln.sg] Neon WebMail for Java Multiple Vulnerabilities
vuln.sg Vulnerability Research Advisory Neon WebMail for Java Multiple Vulnerabilities by Tan Chew Keong Release Date: 2006-09-20 Summary ------- 7 vulnerabilities have been found in Neon WebMail for Java. When exploited, these vulnerabilities allow executing of arbitrary JSP code, escalation of...
NeoSys Neon Webmail for Java 5.06/5.07 - 'addrlist' Servlet Multiple SQL Injections
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
NeoSys Neon Webmail for Java 5.06/5.07 - 'updatemail' Servlet Arbitrary Mail Message Manipulation
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_id' Servlet Arbitrary User Information Modification
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
NeoSys Neon Webmail for Java 5.065.07 - downloadfile Servlet Traversal Arbitrary File Access
NeoSys Neon Webmail for Java 5.065.07 - downloadfile Servlet Traversal Arbitrary File Access...
NeoSys Neon Webmail for Java 5.065.07 - updateuser?in_name Servlet Cross-Site Scripting
NeoSys Neon Webmail for Java 5.065.07 - updateuser?inname Servlet Cross-Site Scripting...
NeoSys Neon Webmail for Java 5.065.07 - maillist Servlet Multiple SQL Injections
NeoSys Neon Webmail for Java 5.065.07 - maillist Servlet Multiple SQL Injections source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-uplo...
NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_name' Servlet Cross-Site Scripting
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
NeoSys Neon Webmail for Java 5.06/5.07 - 'downloadfile' Servlet Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...
NeonResponder-5.4.txt
Author: Stefan Lochbihler Date: 17.04.2006 Affected Software: Neon Responder for Windows Software 5.4 Software http://www.neon.com/NRwin.shtml Attack: Dos Overview: Neon Responders greatly enhance the functionality of LANsurveyor by providing LANsurveyor with direct access to computers with the...
