CVE-2011-2753

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the empty trash implementation and 2 the Index Order aka optionsorder page, a different issue than...

CVE-2011-2753

SquirrelMail vulnerable: CSRF flaws in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack a user’s session via CSRF on the Empty Trash and Index Order pages (CVE-2011-2753; related CVEs also listed). Impact is described as authentication hijack of unspecified victims; no exploitatio...

CVE-2011-2752

CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n newline character, a different vulnerability than CVE-2010-4555...

CVE-2011-2752

SquirrelMail 1.4.21 and earlier are affected by a CRLF injection (via a newline in input) that allows remote attackers to modify or add user preference values. This is documented as CVE-2011-2752. The issue arises from handling input in preference fields; John Doe? No vendor.

CVE-2011-2023

Cross-site scripting XSS vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message...

CVE-2010-4554

functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

CVE-2010-4554

functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-2023

Cross-site scripting XSS vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message...

Cross site scripting

Cross-site scripting XSS vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message...

Hardcoded credentials

functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

CVE-2011-2023

Cross-site scripting XSS vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message...

CVE-2010-4554

functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2010-4555

SquirrelMail (PHP webmail) versions up to 1.4.21 and earlier are affected by multiple XSS vulnerabilities (CVE-2010-4555, among others) via vectors including dropdown lists, the SquirrelSpell > character, and errors on the Index Order page. Open-source advisories and Nessus/OpenVAS feeds indic...

CVE-2010-4554

CVE-2010-4554 affects SquirrelMail 1.4.21 and earlier: the function page_header.php did not prevent rendering in a frame, enabling clickjacking via a crafted site. Remediation is via the backported patches in the 2012 security updates (e.g., RHSA-2012:0103 / ELSA-2012-0103) that restrict the main...

CVE-2011-2023

CVE-2011-2023 affects SquirrelMail

SquirrelMail 1.x 存在多个安全漏洞

CVE ID：CVE-2010-4554 CVE-2010-4555 CVE-2011-2023 SquirrelMail是一款基于PHP的WEB邮件服务程序。 SquirrelMail存在多个安全漏洞，允许恶意用户进行跨站脚本注入攻击，绕过安全限制等攻击。 1部分传递给消息中样式标签的输入在functions/mime.php使用之前缺少过滤，可导致跨站脚本攻击。 2部分传递给下拉选择列表的部分输入在functions/options.php使用之前缺少过滤，可导致跨站脚本攻击。...