CVE-2002-1276

An incomplete fix for a cross-site scripting XSS vulnerability in SquirrelMail 1.2.8 calls the striptags function on the PHPSELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks...

CVE-2002-1276

CVE-2002-1276 concerns SquirrelMail XSS due to an incomplete fix in version 1.2.8 where strip_tags is applied to PHP_SELF but not saved back, leaving room for injection. OpenVAS notes the read_body.php path (SquirrelMail 1.2.9/1.2.10) as vulnerable to multiple parameter XSS. Debian security advis...

CVE-2002-1276

An incomplete fix for a cross-site scripting XSS vulnerability in SquirrelMail 1.2.8 calls the striptags function on the PHPSELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks...

CVE-2002-1276: Undefined Security Weakness

An incomplete fix for a cross-site scripting XSS vulnerability in SquirrelMail 1.2.8 calls the striptags function on the PHPSELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks...

[SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-2 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-2 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs

-------------------------------------------------------------------------- Debian Security Advisory DSA 191-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2002 http://www.debian.org/security/faq -...

DSA-191 squirrelmail - cross site scripting

Bulletin has no description...

CVE-2002-1132

SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script...

CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

CVE-2002-1131

The SquirrelMail webmail package (versions 1.2.6/1.2.7 and earlier) is vulnerable to Cross-Site Scripting (XSS) due to insufficient sanitization of user-supplied input. Specifically, the Virtual Keyboard plugin and the addressbook.php , options.php , search.php , and help.php files are affected. ...

CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

CVE-2002-1131: Undefined Security Weakness

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

SquirrelMail 1.2.61.2.7 - Multiple Cross-Site Scripting Vulnerabilities

SquirrelMail 1.2.61.2.7 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/5763/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. Multiple cross site scripting...

SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/5763/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. Multiple cross site scripting vulnerabilities have been discovered in various PHP scripts included with...

CVE-2002-0516

SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie...

SquirrelMail compose.php script does not adequately validate input thereby allowing arbitrary user to send messages

Overview Some versions of SquirrelMail do not properly validate input. Attackers can spoof email addresses through this vulnerability. Description SquirrelMail is a collection of PHP4 scripts that provides webmail services. Prior to version 1.24, SquirrelMail does not properly validate Universal...

squirrelmail 1.2.5 email user can execute command

email user can append $THEME variable through cookies ---------------- start sq125x --------------------- !/bin/bash squirrelmail-1.2.5 remote execution by pokleyzz http://www.inetd-secure.net usage : ./sq125x themecount username password url command example : ./sq125x 2 pokley 123456...

SquirrelMail 1.2.x - Theme Remote Command Execution

SquirrelMail 1.2.x - Theme Remote Command Execution source: https://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality throu...