CVE-2012-5623

CVE-2012-5623 concerns Squirrelmail 4.0 using the outdated MD5 hashing algorithm for passwords. According to the connected records, the issue arises from the use of MD5 for password hashing, which can lead to weakened password security. The NVD entry lists CVSSv3.1 metrics with a base score of 7....

CVE-2012-5623

Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords...

CVE-2018-14955

The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations animate to attribute...

Fedora Update for squirrelmail FEDORA-2019-1a87523729

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: squirrelmail-1.4.23-1.fc29.20190710

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Fedora Update for squirrelmail FEDORA-2019-ad02f64a79

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: squirrelmail-1.4.23-1.fc30.20190710

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Debian DLA-1868-1 : squirrelmail security update

A XSS vulnerability was discovered in SquirrelMail. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mails can be executed within the application context via crafted use of for example a NOEMBED...

Debian: Security Advisory (DLA-1868-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1868-1] squirrelmail security update

Package : squirrelmail Version : 2:1.4.23svn20120406-2+deb8u4 CVE ID : CVE-2019-12970 A XSS vulnerability was discovered in SquirrelMail. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mails c...

DLA-1868-1 squirrelmail - security update

Bulletin has no description...

Code Injection

SquirrelMail is vulnerable to code injection. With registerglobals enabled, an attacker could inject arbitrary code via custom preference handles in prefs.php and may cause the code to be executed with application privilege...

CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

SquirrelMail Cross-Site Scripting Vulnerability (CNVD-2019-20986)

SquirrelMail is a set of PHP language development , cross-platform Webmail mail system . A cross-site scripting vulnerability exists in SquirrelMail versions 1.4.22 and later and version 1.5.x before 1.5.2. The vulnerability stems from a lack of proper validation of client data by the web...

CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

UBUNTU-CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

Design/Logic Flaw

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...

CVE-2019-12970

CVE-2019-12970 is a disclosed XSS in SquirrelMail prior to updates addressing versions up to 1.4.22 and 1.5.x through 1.5.2. Root cause: improper handling of RCDATA/RAWTEXT in the sanitization mechanism allows bypass, enabling malicious script injection from HTML e-mails when assets such as NOEMB...