[SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-2 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

DSA-191 squirrelmail - cross site scripting

Bulletin has no description...

CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

CVE-2002-1132

SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script...

CVE-2002-1131

SquirrelMail 1.2.6/1.2.7 is affected by a cross-site scripting vulnerability in the Virtual Keyboard plugin due to insufficient input sanitization. This could allow an attacker to execute arbitrary script in the victim’s browser (affecting users via the plugin). Debian/OpenVAS entries indicate fi...

CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

SquirrelMail 1.2.61.2.7 - Multiple Cross-Site Scripting Vulnerabilities

SquirrelMail 1.2.61.2.7 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/5763/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. Multiple cross site scripting...

SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/5763/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. Multiple cross site scripting vulnerabilities have been discovered in various PHP scripts included with...

CVE-2002-0516

SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie...

SquirrelMail compose.php script does not adequately validate input thereby allowing arbitrary user to send messages

Overview Some versions of SquirrelMail do not properly validate input. Attackers can spoof email addresses through this vulnerability. Description SquirrelMail is a collection of PHP4 scripts that provides webmail services. Prior to version 1.24, SquirrelMail does not properly validate Universal...

squirrelmail 1.2.5 email user can execute command

email user can append $THEME variable through cookies ---------------- start sq125x --------------------- !/bin/bash squirrelmail-1.2.5 remote execution by pokleyzz http://www.inetd-secure.net usage : ./sq125x themecount username password url command example : ./sq125x 2 pokley 123456...

SquirrelMail 1.2.x - Theme Remote Command Execution

SquirrelMail 1.2.x - Theme Remote Command Execution source: https://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality throu...

SquirrelMail 1.2.x - Theme Remote Command Execution

source: https://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system. A vulnerability has been reporte...

CVE-2001-1159

loadprefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to 1 view sensitive files via the configphp and datadir options, and 2 execute arbitrary code by using optionsorder.php to upload a message...

CVE-2001-1159

SquirrelMail 1.0.4 and earlier are affected by CVE-2001-1159 due to improper initialization of PHP variables in load_prefs.php and related include files. This allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary PHP code by uploadi...

Vulnerabilities in squirrelmail

Multiple security vulnerabilties exist in SquirrelMail v 1.2.3 that allow malicious HTML messages to: send messages appearing to come from the user run arbitrary javascript Description ----------- The compose.php script allows parameters to be passed as GETs. Therefore including the following in ...

squirrelmail bug

Squirrelmail remote execute commands bug Version Affected : 1.2.2 Squirrelmail is a webmail system, which allows users to send, get, read etc. mails. It has some themes, plugins etc. One of the plugins has a very interesting piece of code : from file checkme.mod.php : $sqspellcommand =...

(SRADV00010) Remote command execution vulnerabilities in SquirrelMail

================================================= Secure Reality Pty Ltd. Security Advisory 10 SRADV00010 http://www.securereality.com.au ================================================= Title Remote command execution vulnerabilities in SquirrelMail Released 2/7/2001 Vulnerable Versions up to an...