SquirrelMail vulnerable to cross-site request forgery

Overview SquirrelMail contains a cross-site request forgery vulnerability. SquirrelMail from SquirrelMail Project is an open source webmail web-based email. SquirrelMail contains an issue in processing of sending a message or setting changes, which may result in cross-site request forgery. Daiki...

SquirrelMail vulnerable to cross-site scripting

Overview SquirrelMail contains a cross-site scripting vulnerability. SquirrelMail from SquirrelMail Project is an open source webmail web-based email. SquirrelMail contains an issue in handling specific character encoding and processing "data:" URL, which may result in cross-site scripting. Yosuk...

JVN#09157962: SquirrelMail vulnerable to cross-site scripting

SquirrelMail from SquirrelMail Project is an open source webmail web-based email. SquirrelMail contains an issue in handling specific character encoding and processing "data:" URL, which may result in cross-site scripting. Impact An arbitrary script may be executed on the user's web browser...

JVN#30881447: SquirrelMail vulnerable to cross-site request forgery

SquirrelMail from SquirrelMail Project is an open source webmail web-based email. SquirrelMail contains an issue in processing of sending a message or setting changes, which may result in cross-site request forgery. Impact A remote attacker may send an arbitrary email or change the settings...

[Suspected Spam]XSS in Squirrelmail plugin 'Virtual Keyboard' <= 0.9.1

Hi, Squirrelmail plugin 'Virtual Keyboard' version 0.9.1 and lower is vulnerable to cross site scripting XSS. The vkeyboard.php script fails to sanitize the value of HTTP GET parameter 'passformname' which the script stores in a variable of the same name and outputs unmodified into a HTML documen...

SquirrelMail Virtual Keyboard Plugin - vkeyboard.php Cross-Site Scripting

SquirrelMail Virtual Keyboard Plugin - vkeyboard.php Cross-Site Scripting source: https://www.securityfocus.com/bid/43749/info The Virtual Keyboard plugin for SquirrelMail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may...

SquirrelMail Virtual Keyboard Plugin - 'vkeyboard.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43749/info The Virtual Keyboard plugin for SquirrelMail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

SquirrelMail Virtual Keyboard 0.9.1 Cross Site Scripting

Hi, Squirrelmail plugin 'Virtual Keyboard' version 0.9.1 and lower is vulnerable to cross site scripting XSS. The vkeyboard.php script fails to sanitize the value of HTTP GET parameter 'passformname' which the script stores in a variable of the same name and outputs unmodified into a HTML documen...

Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)

Check for the Version of squirrelmail OpenVAS Vulnerability Test Mandriva Update for squirrelmail MDVSA-2010:158 squirrelmail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)

Check for the Version of squirrelmail OpenVAS Vulnerability Test Mandriva Update for squirrelmail MDVSA-2010:158 squirrelmail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

SquirrelMail PGP Plugin - Command Execution (SMTP) (Metasploit)

$Id: squirrelmailpgpplugin.rb 10148 2010-08-25 20:31:46Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Debian Security Advisory DSA 2091-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 2091-1. OpenVAS Vulnerability Test $Id: deb20911.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2091-1 squirrelmail Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft In...

Debian: Security Advisory (DSA-2091-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2813

functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to the creation of many preferences file...

CVE-2010-2813

functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to the creation of many preferences file...

Design/Logic Flaw

functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to the creation of many preferences file...

CVE-2010-2813

functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to the creation of many preferences file...

CVE-2010-2813

SquirrelMail’s imap_general.php vulnerability (CVE-2010-2813) affects versions prior to 1.4.21, where 8-bit password handling allows remote attackers to trigger a denial of service (disk consumption) by issuing numerous IMAP login attempts with different usernames, causing many preferences files ...

Debian DSA-2091-1 : squirrelmail - No user-specific token implemented

SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery CSRF attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other...

[SECURITY] [DSA 2091-1] New squirrelmail packages fix cross-site request forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2091-1 [email protected] http://www.debian.org/security/ Luciano Bello August 12, 2010 http://www.debian.org/security/faq -...