CVE-2019-13389

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header...

UBUNTU-CVE-2019-13389

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header...

CVE-2019-13389

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header...

CVE-2019-13389

Summary of CVE-2019-13389 : RainLoop Webmail prior to 1.13.0 is vulnerable due to missing XSS protections (no xlink:href validation, no X-XSS-Protection header, and no Content-Security-Policy header). The vulnerability can lead to cross-site scripting as described in multiple sources. Exploitatio...

PT-2020-9397 · Unknown · Rainloop Webmail

Name of the Vulnerable Software and Affected Versions: RainLoop Webmail versions prior to 1.13.0 Description: The issue lacks XSS protection mechanisms, including xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header. Recommendations: For versions prior to...

CVE-2019-13389: Improper Neutralization of Input During Web Page Generation

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header...

CVE-2019-13389

Removed by vendor...

cPanel Authentication Bypass Vulnerability (CNVD-2020-18549)

cPanel is a set of Web-based host control management system of the U.S. cPanel. An authentication bypass vulnerability exists in versions of cPanel prior to 82.0.18. The vulnerability stems from inconsistent handling of Webmail usernames. An attacker can exploit this vulnerability to achieve...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Code injection

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

Authentication flaw

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2019-20490

CVE-2019-20490 affects cPanel versions prior to 82.0.18, where authentication bypass arises from inconsistent handling of Webmail usernames. The issue is confirmed across multiple sources (including Red Hat and CNVD entries) and is tied to the SEC-499 handling logic. The vulnerability enables byp...

CVE-2020-10122: Undefined Security Weakness

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2019-20490: Undefined Security Weakness

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Horde Groupware Webmail Code Issue Vulnerability

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A code issue vulnerability exists in the add.php script in Horde Groupware Webmail Edition version 5.2.22, which stems from the program failing to properly validate user-submitted input. An attacker...

Horde Groupware Webmail Edition 5.2.22 PHAR Loading

exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 source =...