Surgemail and WebMail 3.0 - Page Remote Format String

Surgemail and WebMail 3.0 - Page Remote Format String source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier...

Surgemail and WebMail 3.0 - 'Page' Remote Format String

source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. A remote...

SmarterMail Enterprise 4.3 - malformed mail XSS

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbo...

CVE-2008-0807

lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...

CVE-2008-0807: Undefined Security Weakness

lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...

MailBee WebMail Pro 'download_view_attachment.aspx'本地文件包含漏洞

MailBee WebMail Pro是一款基于ASPX的WEB应用程序。 MailBee WebMail Pro不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'downloadviewattachment.aspx'脚本对用户提交的'tempfilename'参数处理缺少充分过滤，提交多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容. AfterLogic MailBee WebMail Pro 厂商解决方案 目前没有解决方案提供： http://www.afterlogic.com/...

Directory traversal

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

The CVE-2008-0333 issue concerns AfterLogic MailBee WebMail Pro for ASP.NET (version 4.1) where a directory traversal flaw in download_view_attachment.aspx allows reading arbitrary files via .. in the temp_filename parameter. Root cause: unvalidated input in the downloadViewAttachment endpoint en...

PT-2008-1966 · Afterlogic +1 · Afterlogic Mailbee Webmail Pro +1

Name of the Vulnerable Software and Affected Versions: AfterLogic MailBee WebMail Pro version 4.1 for ASP.NET Description: The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the download view attachment.aspx file. This is achieved by using a...

Debian Security Advisory DSA 1290-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 1290-1. OpenVAS Vulnerability Test $Id: deb12901.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1290-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1241-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 1241-1. Martijn Brinkers discovered cross-site scripting vulnerabilities in the the mailto parameter of webmail.php, the session and deletedraft parameters of compose.php and through a shortcoming in the magicHTML...

MailBee WebMail Pro 4.1 (ASP.NET) Remote File Disclosure Vulnerability

No description provided by source. homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=-...

mailbee-rfd.txt

homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=-...

Debian Security Advisory DSA 220-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 220-1. OpenVAS Vulnerability Test $Id: deb2201.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 220-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CVE-2008-0333: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

Debian Security Advisory DSA 988-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 988-1. Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-0188 Martijn Brinkers a...

Debian: Security Advisory (DSA-662-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-988-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...