Directory traversal

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

Design/Logic Flaw

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3170

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3172

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

CVE-2007-3170

CVE-2007-3170 relates to multiple XSS vulnerabilities in UebiMiau Webmail. The affected component is the webmail PHP application, with two identified vectors: (1) PATH_INFO to redirect.php and (2) the selected_theme parameter to demo/pop3/error.php. The underlying issue is insufficient sanitizati...

CVE-2007-3170

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3171

Affected software/impact: Uebimiau Webmail is vulnerable to information disclosure. The issue occurs in the demo/pop3/error.php script when an invalid value is supplied for the smarty or selected_theme parameter, which causes error messages to reveal the installation path. Root cause (as describe...

CVE-2007-3172

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

CVE-2007-3172

CVE-2007-3172 relates to a directory traversal in UebiMiau Webmail via the demo/pop3/error.php (selected_theme parameter) that allows remote disclosure of directory existence. Connected sources describe a broader set of input-validation issues in UebiMiau’s error.php: similar traversal/file-discl...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3170: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to redirect.php or 2 the selectedtheme parameter to demo/pop3/error.php...

CVE-2007-3171: Undefined Security Weakness

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-3172: Undefined Security Weakness

Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. dot dot in the selectedtheme parameter...

madirish-rfi.txt

Madirish Webmail v2.0 Remote File Include Vulnerabilities Author : BoZKuRTSeRDaR Contact MSN:[email protected] My Homepage :WwW.Turkmilliyetcileri.OrG script Download : http://sourceforge.net/projects/madirishwebmail code: requireonce$GLOBALS'basedir'."lib/sql.php" exploit:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

CVE-2007-3058

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

CVE-2007-3058

CVE-2007-3058 affects Madirish Webmail 2.0 (lib/addressbook.php). The flaw is a PHP remote file inclusion via a URL in the GLOBALS[basedir] parameter, exploitable through multiple pages (calendar.php, compose.php, index.php). The description in the sources confirms a remote code execution vector,...

CVE-2007-3058

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...