4286 matches found
[SECURITY] [DSA 2291-1] squirrelmail security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2291-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 8, 2011 http://www.debian.org/security/faq -...
DSA-2291-1 squirrelmail - various issues
Bulletin has no description...
South Korean social network hacked, 35 million users Data at risk
South Korean social network hacked, 35 million users Data at risk 35 million users Personal information of a South Korean social network site may have been exposed. Local authorities were quick to blame hack attacks against the Cyworld social networking website and the Nate web portal – both of...
Fedora Update for squirrelmail FEDORA-2011-9311
Check for the Version of squirrelmail OpenVAS Vulnerability Test Fedora Update for squirrelmail FEDORA-2011-9311 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
[SECURITY] Fedora 14 Update: squirrelmail-1.4.22-2.fc14
SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...
[SECURITY] Fedora 15 Update: squirrelmail-1.4.22-2.fc15
SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...
SquirrelMail 1.x 存在多个安全漏洞
CVE ID：CVE-2010-4554 CVE-2010-4555 CVE-2011-2023 SquirrelMail是一款基于PHP的WEB邮件服务程序。 SquirrelMail存在多个安全漏洞，允许恶意用户进行跨站脚本注入攻击，绕过安全限制等攻击。 1部分传递给消息中样式标签的输入在functions/mime.php使用之前缺少过滤，可导致跨站脚本攻击。 2部分传递给下拉选择列表的部分输入在functions/options.php使用之前缺少过滤，可导致跨站脚本攻击。...
MDaemon WorldClient < 12.0.3 Summary Page Email Subject XSS
According to its banner, the version of MDaemon's WorldClient webmail client running on this port is earlier than 12.0.3. The LookOut theme in such versions reportedly may interpret JavaScript in a message subject in the Summary view. By sending a specially crafted email to a user who reads mail...
linux-flashplugin -- cross-site scripting vulnerability
Adobe Product Security Incident Response Team reports: An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site...
Debian Security Advisory DSA 2204-1 (imp4)
The remote host is missing an update to imp4 announced via advisory DSA 2204-1. OpenVAS Vulnerability Test $Id: deb22041.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2204-1 imp4 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...
CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...
CVE-2011-1491
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an...
CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...
CVE-2011-1491
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an...
DEBIAN-CVE-2011-1491
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an...
Cross site request forgery (csrf)
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...
Cross site request forgery (csrf)
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an...
CVE-2011-1491
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an...
CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...
CVE-2011-1492
CVE-2011-1492 affects Roundcube Webmail prior to 0.5.1. The issue is in steps/utils/modcss.inc, where requests for an external CSS stylesheet are not properly verified, allowing remote authenticated users to trigger arbitrary outbound TCP connections from the server and potentially obtain sensiti...