Design/Logic Flaw

IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428...

CVE-2007-0977

IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428...

CVE-2007-0977

CVE-2007-0977 involves IBM Lotus Domino R5/R6 WebMail. When the option “Generate HTML for all fields” is enabled (default in these versions), HTTPPassword hashes and related data from names.nsf can be read via ReadViewEntries/OpenDocument on the defaultview, exposing passwords and client/version ...

Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit

No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, ...

Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit

No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stor...

Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit

Exploit for unknown platform in category remote exploits ============================================================== Lotus Domino Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attacke...

Lotus Domino R6 Webmail - Remote Password Hash Dumper

!/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields,...

uebimiau-xss.txt

Uebimiau index.php Cross-Site Scripting Vulnerability Uebimiau is an universal webmail developed in PHP. This issue is due to a failure in the application to properly sanitize user-supplied input. Attackers may exploit this issue via a web client. An attacker may leverage this issue to have...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2007:0022 A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An...

Moderate: Red Hat Security Advisory: squirrelmail security update

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary Javascript or HTML...

CVE-2007-0579

Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2007-0579

CVE-2007-0579 affects Horde Groupware Webmail Edition before 1.0 and Groupware before 1.0. Unspecified vulnerability in the calendar component allows remote attackers to include certain files via unspecified vectors. No further technical details or remediation are provided in the accessible docum...

[NETRAGARD-20061218 SECURITY ADVISORY] [@Mail WebMail Cross Site Request Forgery]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Netragard, L.L.C Advisory ATMAIL-XRRF-ADVISORY-20061218 Strategic Reconnaissance Team ------------------------------------------------ http://www.netragard.com -- "We make I.T. Safe." POSTING NOTICE -...

[SECURITY] Fedora Core 6 Update: squirrelmail-1.4.8-3.fc6

SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...

[SECURITY] Fedora Core 5 Update: squirrelmail-1.4.8-3.fc5

SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure...

Debian DSA-1241-1 : squirrelmail - XSS

Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and deletedraft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user's webmail...

[SECURITY] [DSA 1241-1] New squirrelmail packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1241-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 25th, 2006 http://www.debian.org/security/faq -...

DSA-1241-1 squirrelmail

Bulletin has no description...

CVE-2006-6701

Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...

CVE-2006-6700

Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...