cPanel and WHM Multiple Cross Site Scripting Vulnerabilities

cPanel is a Unix based fully featured popular web based hosting account control panel that helps webmasters to manage their domains through a web browser. The latest version of cPanel & WHM is 11.34, which is vulnerable to multiple cross site scripting. During my bug hunting process, today I...

cPanel WebHost Manager (WHM) - webmailx3mailclientconf.html?acct Cross-Site Scripting

cPanel WebHost Manager WHM - webmailx3mailclientconf.html?acct Cross-Site Scripting source: https://www.securityfocus.com/bid/57060/info cPanel and WHM are prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage...

cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting

source: https://www.securityfocus.com/bid/57060/info cPanel and WHM are prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

CVE-2012-5590

SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-5590

The CVE-2012-5590 issue affects the Drupal Webmail Plus contributed module. The vulnerability is a SQL injection caused by insufficient sanitization of user input used in a database query, allowing remote attackers to execute arbitrary SQL commands. Affected: all Webmail Plus module versions. Imp...

CVE-2012-5590

SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2012-6040

Name of the Vulnerable Software and Affected Versions Drupal Webmail Plus module affected versions not specified Description A SQL injection issue in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands. Recommendations At the moment, there is no informatio...

CVE-2012-5590: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

IceWarp Webmail raw.php Information Disclosure

The version of IceWarp installed on the remote host is affected by an information disclosure vulnerability. A remote, unauthenticated attacker may be able to view PHP configuration information via the phpinfo function by requesting the webmail/pda/controller/raw.php script. %NASLMINLEVEL 70300 C...

CVE-2012-5569

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

CVE-2012-5569

CVE-2012-5569 affects the Drupal Basic webmail module (6.x-1.x prior to 6.x-1.2). The root cause is several XSS flaws that allow remote attackers to inject arbitrary script/HTML via the page title or crafted email messages. Impact is limited to sites using this contributed module; successful expl...

CVE-2012-5569

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

CVE-2012-5569

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

CVE-2012-5569: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

PT-2012-6030

Name of the Vulnerable Software and Affected Versions Drupal Basic webmail module version 6.x-1.x before 6.x-1.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via a page title or a crafted email message, potentially leading to cross-site scripting XSS attack...

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)

The Webmail plus module is a full-featured email client for Drupal. It's designed to provide email for any or all members of a Drupal site. The module doesn't sufficiently sanitize user input as it is used in a database query. CVE: CVE-2012-5590 Versions affected All Webmail Plus module versions...

CVE-2012-0209

Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification Trojan Horse in templates/javascript/opencalendar.js, which allows remote attackers to execute arbitrary...

CVE-2012-0209

CVE-2012-0209 corresponds to a backdoor backdoor in Horde 3.3.12 and Horde Groupware 1.2.10/1.2.10 Webmail, introduced via an unauthorized modification in templates/javascript/open_calendar.js. Affected packages include Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2...