CVE-2012-1253

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

CVE-2012-1253

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

Hexamail Server 4.4.5 Cross Site Scripting

Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; root@bt:/ Send email to the victim: root@bt:/ sendemail -f [email protected] -t [email protected] -xu [email protected] \ -xp bob123 -u "Want some meal..?" -o message-file=meal.txt -s mail.examp...

PT-2012-3170

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment when using Internet Explorer. Recommendation...

CVE-2012-1253: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

[SECURITY] [DSA 2485-1] imp4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2485-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst June 3, 2012 http://www.debian.org/security/faq -...

DSA-2485-1 imp4 - cross site scripting

Bulletin has no description...

Hexamail Server <= 4.4.5 Persistent XSS Vulnerability

Exploit for windows platform in category web applications Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; email protected:/ Send email to the victim: email protected:/ sendemail -f email protected -t email protected -xu email protected \ -xp...

Roundcube Webmail vulnerable to cross-site scripting

Overview Roundcube webmail contains a cross-site scripting vulnerability. Roundcube Webmail is an open source webmail client from the Roundcube Webmail Project. Roundcube Webmail contains a cross-site scripting vulnerability. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this...

JVN#21422837: Roundcube Webmail vulnerable to cross-site scripting

Roundcube Webmail is an open source webmail client from the Roundcube Webmail Project. Roundcube Webmail contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's Internet Explorer when viewing a specially crafted image file. Solution Update the...

CVE-2012-1916

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1918

Multiple directory traversal vulnerabilities in 1 compose.php and 2 libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. dot dot in the Attachment parameter...

CVE-2012-1917

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

CVE-2012-1920

@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function...

Information disclosure

@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function...

Directory traversal

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

Code injection

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1916

CVE-2012-1916 affects the @Mail WebMail Client in AtMail Open-Source prior to version 1.05. The issue allows remote attackers to execute arbitrary code by delivering an email with an attachment that has an executable extension, resulting in creation of an executable file under tmp/. This is descr...

CVE-2012-1917

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ dot dot slash sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ dot dot dot slash dot slash sequence...

CVE-2012-1919

CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. dot dot in the file parameter...