EUVD-2007-3162

Malware in sbrugna...

CVE-2013-2622: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selectedtheme" parameter in error.php...

Directory traversal

Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the selectedtheme parameter, a different vector than CVE-2007-3172...

CVE-2008-0140: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the selectedtheme parameter, a different vector than CVE-2007-3172...

CVE-2007-3170

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3170

CVE-2007-3170 relates to multiple XSS vulnerabilities in UebiMiau Webmail. The affected component is the webmail PHP application, with two identified vectors: (1) PATH_INFO to redirect.php and (2) the selected_theme parameter to demo/pop3/error.php. The underlying issue is insufficient sanitizati...

CVE-2007-3170: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3171: Undefined Security Weakness

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3172: Undefined Security Weakness

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...