CVE-2019-13389

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header...

CVE-2019-13389

Summary of CVE-2019-13389 : RainLoop Webmail prior to 1.13.0 is vulnerable due to missing XSS protections (no xlink:href validation, no X-XSS-Protection header, and no Content-Security-Policy header). The vulnerability can lead to cross-site scripting as described in multiple sources. Exploitatio...

PT-2020-9397 · Unknown · Rainloop Webmail

Name of the Vulnerable Software and Affected Versions: RainLoop Webmail versions prior to 1.13.0 Description: The issue lacks XSS protection mechanisms, including xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header. Recommendations: For versions prior to...

CVE-2019-13389

Removed by vendor...

cPanel Authentication Bypass Vulnerability (CNVD-2020-18549)

cPanel is a set of Web-based host control management system of the U.S. cPanel. An authentication bypass vulnerability exists in versions of cPanel prior to 82.0.18. The vulnerability stems from inconsistent handling of Webmail usernames. An attacker can exploit this vulnerability to achieve...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Authentication flaw

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Code injection

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2019-20490

CVE-2019-20490 affects cPanel versions prior to 82.0.18, where authentication bypass arises from inconsistent handling of Webmail usernames. The issue is confirmed across multiple sources (including Red Hat and CNVD entries) and is tied to the SEC-499 handling logic. The vulnerability enables byp...

Horde Groupware Webmail Code Issue Vulnerability

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A code issue vulnerability exists in the add.php script in Horde Groupware Webmail Edition version 5.2.22, which stems from the program failing to properly validate user-submitted input. An attacker...

Horde Groupware Webmail Edition 5.2.22 PHAR Loading

exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 source =...

AtMail WebMail 4.61 Open Redirect

Title: AtMail WebMail Open Redirect Vulnerability + Date: 2020/03/11 + Author: Lutfu Mert Ceylan + Vendor Homepage: www.atmail.com + Software: Atmail Cloud Hosted Email + Tested on: Windows 10 + Versions: 4.61 and before + Vulnerable Parameter: "redirect" Get Method + Vulnerable File:...

Horde Groupware Webmail Edition 5.2.22 PHP File Inclusion

exploit-inc-inclusion.py !/usr/bin/env python3 from horde import Horde import subprocess import sys TEMPDIR = '/tmp' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 log into the web application horde = Hordebaseurl,...

Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion Exploit

Exploit for php platform in category web applications exploit-inc-inclusion.py !/usr/bin/env python3 from horde import Horde import subprocess import sys TEMPDIR = '/tmp' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode =...

Horde Groupware Webmail Edition 5.2.22 - PHAR Loading Exploit

Exploit for php platform in category web applications exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password =...

Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion

Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion exploit-inc-inclusion.py !/usr/bin/env python3 from horde import Horde import subprocess import sys TEMPDIR = '/tmp' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode =...