Atmail WebMail 7.0.2 Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2013-014 - Original release date: March 25th, 2013 - Last revised: March 25th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 4.3/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6229...

Ability Mail Server 2013 - Password Reset CSRF from Stored XSS (Web UI)

Exploit for windows platform in category web applications On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a use...

Ability Mail Server 2013 -Persistent Cross-Site Scripting Cross-Site Request Forgery (Password Reset)

Ability Mail Server 2013 -Persistent Cross-Site Scripting Cross-Site Request Forgery Password Reset On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and...

Ability Mail Server 2013 -Persistent Cross-Site Scripting / Cross-Site Request Forgery (Password Reset)

On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a user named, victim, with a password of victim 5. Finish...

AfterLogic Pro and Lite 7.1.1.1存储型跨站脚本漏洞

No description provided by source. ?php / Exploit Title : AfterLogic Pro and Lite = 7.1.1.1 Stored XSS Google Dork : intext:"AfterLogic" intext:"Login Information" inurl:index.php Date : 19 Jan 2014 Exploit Author : Saeed reza Zamanian s.zamanian AT imenantivirus.com Vendor Homepage:...

AfterLogic Pro and Lite <= 7.1.1.1 Stored XSS Vulnerability

XSS codes can be stored in E-Mail Body. So you can send an email to the Victim with below payload and steal the victim's cookie. Usage Info Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer directory:...

AfterLogic Pro and Lite 7.1.1.1 - Persistent Cross-Site Scripting

AfterLogic Pro and Lite 7.1.1.1 - Persistent Cross-Site Scripting Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/AfterLogic/Default.aspx Phpmailer class is included in the exploit so you nee...

AfterLogic Pro / Lite 7.1.1.1 Cross Site Scripting

Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/AfterLogic/Default.aspx Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer...

Atmail Webmail Server - Email Body HTML Injection

Atmail Webmail Server - Email Body HTML Injection source: https://www.securityfocus.com/bid/64779/info Atmail Webmail Server is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentiall...

Atmail Webmail Server - Email Body HTML Injection

source: https://www.securityfocus.com/bid/64779/info Atmail Webmail Server is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

CVE-2013-6028

Multiple cross-site request forgery CSRF vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts, 2 modify user accounts, 3 delete user accounts, or 4 stop the product's service...

CVE-2013-6017

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

Cross site scripting

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts, 2 modify user accounts, 3 delete user accounts, or 4 stop the product's service...

CVE-2013-6028

CVE-2013-6028 applies to Atmail Webmail Server (before 7.2). The connected sources confirm a CSRF vulnerability that lets an attacker hijack administrator authentication to perform actions such as adding, modifying, or deleting user accounts, or stopping the service. The vulnerability stems from ...

CVE-2013-6017

Atmail Webmail Server prior to 7.2 is vulnerable to stored cross-site scripting (XSS) via the body of an e-mail message, demonstrated by an IFRAME SRC attribute. The flaw exists in Atmail Webmail Server versions 6.x/7.x before 7.2.0 and is caused by input validation issues in email handling. Succ...

CVE-2013-6028

Multiple cross-site request forgery CSRF vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts, 2 modify user accounts, 3 delete user accounts, or 4 stop the product's service...

EUVD-2013-5847

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

CVE-2013-6017

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

Atmail Webmail Server version 7.1.3 contains cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities

Overview Atmail Webmail Server version 7.1.3 and possibly earlier versions contain stored cross-site scripting XSS CWE-79 and cross-site request forgery CSRF CWE-352 vulnerabilities. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' -...