Roundcube TimeZone Authenticated File Disclosure

Roundcube Webmail allows unauthorized access to arbitrary files on the host's filesystem, including configuration files. This affects all versions from 1.1.0 through version 1.3.2. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires...

VulnCheck KEV: CVE-2017-16651

Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default...

roundcube -- file disclosure vulnerability

MITRE reports: Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target syst...

Ursnif Banking Trojan Spreading In Japan

Attackers behind the pervasive banking Trojan Ursnif have made Japan one of their top targets, delivering the malware via spam campaigns that began last month. For years, Ursnif or Gozi has targeted Japan along with North America, Europe and Australia. But according to a recent IBM X-Force analys...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

Cross site scripting

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

CVE-2017-7732: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

Cross site scripting

Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...

CVE-2015-5379

Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...

CVE-2015-5379: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...

pop.webmail.co.za XSS vulnerability

Vulnerable URL: http://pop.webmail.co.za/login.php?msg=%22%3E%3Cimg%20src=%22fpg.png%22%20onerror=confirm%27XSSPOSED%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP...

webmail.webmail.co.za XSS vulnerability

Vulnerable URL: http://webmail.webmail.co.za/login.php?msg=%22%3E%3Cimg%20src=%22fpg.png%22%20onerror=confirm%27XSSPOSED%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169...

sms.webmail.co.za XSS vulnerability

Vulnerable URL: http://sms.webmail.co.za/err.php?token=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP website status:| Yes...

web2.webmail.co.za XSS vulnerability

Vulnerable URL: http://web2.webmail.co.za/login.php?msg=%22%3E%3Cimg%20src=%22fpg.png%22%20onerror=confirm%27XSSPOSED%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP...

pop.webmail.co.za XSS vulnerability

Vulnerable URL: http://pop.webmail.co.za/lostpassword.php?email=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 11.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP website status:| Yes Coordinated Disclosure Timeline:...

mail.webmail.co.za XSS vulnerability

Vulnerable URL: http://mail.webmail.co.za/lostpassword.php?email=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 11.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP website status:| Ye...

sms.webmail.co.za XSS vulnerability

Vulnerable URL: http://sms.webmail.co.za/err.php?err=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 11.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20169 VIP website status:| Yes Coordinat...

FortiMail reflected XSS vulnerability under customized webmail login page

There exists a reflected cross-site scripting XSS vulnerability on FortiMail customized pre-authentication webmail login page, allowing successful attackers to run arbitrary javascript code in the security context of their victim's browser...