CVE-2012-1916

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1918

CVE-2012-1918 affects AtMail Open-Source WebMail Client (before 1.05). Vulnerable components are compose.php and libs/Atmail/SendMsg.php, with a directory traversal flaw that allows remote attackers to read arbitrary files via a .. in the Attachment[] parameter. Impact described as reading arbitr...

CVE-2012-1917

CVE-2012-1917 affects AtMail Open-Source (compose.php in the @Mail WebMail Client) prior to version 1.05. The root cause is improper handling of ../ sequences in the unique parameter, allowing remote attackers to perform directory traversal and read arbitrary files via a ..././ sequence. Document...

CVE-2012-1919

CVE-2012-1919 affects AtMail Open-Source’s @Mail WebMail Client (mime.php) prior to version 1.05. The vulnerability is a CRLF injection that allows a remote attacker to perform directory traversal and read arbitrary files by injecting a %0A sequence followed by .. in the file parameter, enabling ...

CVE-2012-1916

CVE-2012-1916 affects the @Mail WebMail Client in AtMail Open-Source prior to version 1.05. The issue allows remote attackers to execute arbitrary code by delivering an email with an attachment that has an executable extension, resulting in creation of an executable file under tmp/. This is descr...

CVE-2012-1917

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

CVE-2012-1918

Multiple directory traversal vulnerabilities in 1 compose.php and 2 libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. dot dot in the Attachment parameter...

PT-2012-3649

Name of the Vulnerable Software and Affected Versions AtMail Open-Source @Mail WebMail Client version prior to 1.05 Description The issue allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension. This leads to the creation of an executable file under...

CVE-2012-1918: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in 1 compose.php and 2 libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. dot dot in the Attachment parameter...

CVE-2012-1916: Undefined Security Weakness

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

PT-2012-3652

Name of the Vulnerable Software and Affected Versions AtMail Open-Source versions prior to 1.05 Description The issue concerns a CRLF injection vulnerability in the mime.php file of the @Mail WebMail Client. This vulnerability allows remote attackers to conduct directory traversal attacks and rea...

@Mail Open webmail client contains multiple vulnerabilities

Overview The @Mail Open 1.04 webmail client contains multiple vulnerabilities including; unrestricted upload of file with dangerous type CWE-434, relative path traversal CWE-23, external control of file name or path CWE-73, and information exposure CWE-200. Description The @Mail Open 1.04 webmail...

New VPN Hunter Service Scans Domains For Remote-Access Systems

If there’s one thing attackers love, it’s readily accessible remote-connection services running on a target company’s network. Once an attacker knows that an organization is running a specific kind of VPN or has RDP enabled on a bunch of machines, he can then start looking for known vulnerabiliti...

CentOS 4 / 5 : squirrelmail (CESA-2012:0103)

An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Mac OS X 10.7.x < 10.7.3 Multiple Vulnerabilities (BEAST)

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.3. The newer version contains multiple security-related fixes for the following components : - Address Book - Apache - ATS - CFNetwork - CoreMedia - CoreText - CoreUI - curl - Data Security - dovecot - filecmds - ImageI...

CVE-2012-0791

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2012-0791

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2012-0791

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2012-0909

CVE-2012-0909 is an XSS in Horde_Form within Horde Groupware Webmail Edition prior to 4.0.6. Public records show fixes in Horde3 branch to 3.3.13 (openSUSE openSUSE-SU-2012:0286-1) and related security updates; remediation involves upgrading to Horde Groupware Webmail Edition 4.0.6 or newer, or H...