CVE-2017-7413

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email...

CVE-2017-7414

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit...

CVE-2017-7413

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email...

CVE-2017-7413

CVE-2017-7413 affects Horde_Crypt prior to 2.7.6 used in Horde Groupware Webmail Edition (through 5.2.17). An OS command injection is possible when an authenticated Horde Webmail user with PGP features enabled encrypts mail to a specially crafted address, enabling potential remote code execution ...

CVE-2017-7414

In Horde_Crypt (PHP Horde) prior to 2.7.6, used in Horde Groupware Webmail Edition 5.x–5.2.17, a crafted PGP-signed email can trigger OS command injection when the recipient views or previews the message. The vulnerability arises when PGP features are enabled and “Should PGP signed messages be au...

CVE-2017-7414

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit...

CVE-2017-7413

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email...

CVE-2017-7413

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email...

CVE-2017-7413: Improper Neutralization of Special Elements used in an OS Command

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email...

CVE-2017-7414: Improper Neutralization of Special Elements used in an OS Command

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit...

PT-2017-17721

Name of the Vulnerable Software and Affected Versions Horde Crypt versions prior to 2.7.6 Horde Groupware Webmail Edition versions 5.x through 5.2.17 Description The issue occurs when a user has PGP features enabled and has chosen to automatically verify PGP signed messages. An attacker can explo...

PT-2017-2370

Name of the Vulnerable Software and Affected Versions Horde Crypt versions prior to 2.7.6 Horde Groupware Webmail Edition versions prior to 5.2.18 Description The issue is related to a lack of input data sanitization, which can lead to OS Command Injection. This can occur if an attacker is an...

RoundCube Webmail mail <1.0.5 body stored XSS（CVE-2015-1433）

RoundCube Webmail is a foreign use of a wide an open source php e-mail system, the meaning is still quite large. roundcube webmail official website: , download the latest version. /program/lib/Roundcube/rcubewashtml.php this file is actually a rich text filter class class rcubewashtml it. roundcu...

Debian DLA-855-1 : roundcube security update

Roundcube, a webmail solution for IMAP servers, was susceptible to a cross-site-scripting XSS vulnerability via a crafted Cascading Style Sheets CSS token sequence within an SVG element or HTML message. For Debian 7 'Wheezy', these problems have been fixed in version 0.7.2-9+deb7u6. We recommend...

[SECURITY] [DLA 855-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u6 CVE ID : CVE-2017-6820 Debian Bug : 857473 Roundcube, a webmail solution for IMAP servers, was susceptible to a cross-site-scripting XSS vulnerability via a crafted Cascading Style Sheets CSS token sequence within an SVG element or HTML message. For...

SMTP STS Coming Soon to Gmail, Other Webmail Providers

Gmail users can expect the introduction of SMTP Strict Transport Security to the email service some time this year, bringing a measure of security similar to certificate pinning to one of the world’s biggest webmail services. Elie Bursztein, the head of Google’s anti-abuse research team, said at...

webmail.koreapop.com XSS vulnerability

Vulnerable URL: http://webmail.koreapop.com/browse/search.php?mode=store=--%3E%3C/script%3E%3C/title%3E%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

Inout Webmail Ultimate Edition 4.0 Script - Improper Access Restrictions Vulnerability

Exploit for php platform in category web applications Vulnerability: Security Bypass Date: 13.01.2017 Vendor Homepage: http://www.inoutscripts.com/ Script Name: Inout Webmail Ultimate Edition v4.0 Script Version: Ultimate Edition v4.0, Ultimate Hypertable Version Script Buy Now:...

Multiple Cross-Site Request Forgery Vulnerabilities in Zimbra

Zimbra is an open source collaborative office suite that includes WebMail, calendar, address book, Web document management and authoring. Zimbra suffers from multiple cross-site request forgery vulnerabilities that allow remote attackers to construct malicious URIs, trick users into parsing them,...

Inout Webmail Ultimate Edition 4.0 Script - Improper Access Restrictions

Inout Webmail Ultimate Edition 4.0 Script - Improper Access Restrictions Vulnerability: Security Bypass Date: 13.01.2017 Vendor Homepage: http://www.inoutscripts.com/ Script Name: Inout Webmail Ultimate Edition v4.0 Script Version: Ultimate Edition v4.0, Ultimate Hypertable Version Script Buy Now...