5045 matches found
[SECURITY] Fedora Core 6 Update: squirrelmail-1.4.8-3.fc6
SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...
[SECURITY] Fedora Core 5 Update: squirrelmail-1.4.8-3.fc5
SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...
Debian DSA-1241-1 : squirrelmail - XSS
Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and deletedraft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user's webmail...
[SECURITY] [DSA 1241-1] New squirrelmail packages fix cross-site scripting
-------------------------------------------------------------------------- Debian Security Advisory DSA 1241-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 25th, 2006 http://www.debian.org/security/faq -...
DSA-1241-1 squirrelmail
Bulletin has no description...
CVE-2006-6700
Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...
CVE-2006-6701
Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...
CVE-2006-6700
Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...
CVE-2006-6701
Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...
CVE-2006-6701
CVE-2006-6701 affects Atmail WebMail: CSRF in util.pl (4.51) and util.php (5.x before 5.03) enables remote manipulation of settings as another user via a crafted HTML email (SRC in IMG). Mitigation: upgrade to 5.0.3 (or later) or apply vendor patches as described in connected advisories.
CVE-2006-6700
Technical details about CVE-2006-6700 are not publicly available in the provided documents. The description notes a vague initial disclosure. Monitor for updates from the sources to obtain affected products, impact, and remediation information.
CVE-2006-6700: Undefined Security Weakness
Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...
CVE-2006-6701: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...
[Full-disclosure] [NETRAGARD-20061220 SECURITY ADVISORY] [@Mail WebMail Cross Site Scripting Vulnerabilitity]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Netragard, L.L.C Advisory Strategic Reconnaissance Team ------------------------------------------------ http://www.netragard.com -- "We make I.T. Safe." POSTING NOTICE - ---------------------------------------------------------------------- If you...
Calacode @Mail Webmail 4.51 - Filtering Engine HTML Injection
source: https://www.securityfocus.com/bid/21708/info Calacode @Mail is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit this issue to execute arbitrary script code in the victim's browser, in the context of the affected...
Know thyself commonly used to hack Email accounts of three methods-vulnerability warning-the black bar safety net
E-mail is not secure, in the mail sending, transmitting and receiving the whole process of each link is there may be a weak link, a malicious user if the use of their vulnerability, it is possible to easily hack the account to get mail content. One, the use of the mail serveroperating...
CVE-2006-6142
Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the 1 mailto parameter in a webmail.php, the 2 session and 3 deletedraft parameters in b compose.php, and 4 unspecified vectors involving "a...
[ISecAuditors Security Advisories] IMAP/SMTP Injection in Hastymail
============================================= INTERNET SECURITY AUDITORS ALERT 2006-011 - Original release date: September 28, 2006 - Last revised: December 1, 2006 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 ============================================= I. VULNERABILITY...
roundcube-XSS.txt
There is an XSS vulnerability in roundcube webmail: http://demo.roundcube.net/?task=';alert%22XSS%22// Btw, we've been posting 0-day XSS vulnerabilities at http://sla.ckers.org/forum/list.php?3 to take it out of the full disclosure list since lots of people don't want to see the sheer volume of...
Roundcube Webmail 0.1 - index.php Cross-Site Scripting
Roundcube Webmail 0.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21042/info Roundcube Webmail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script co...