Design/Logic Flaw

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0792

Cross-site scripting XSS vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0794

CVE-2006-0794 affects V-webmail 1.6.2 via help.php, where remote attackers can obtain the installation path through unspecified invalid parameters. The available documents describe a path-disclosure issue but do not provide detailed root-cause analysis, exploited vectors, or concrete mitigation s...

CVE-2006-0793

CVE-2006-0793 concerns V-webmail 1.6.2. The vulnerability is in frameset.php, where a remote attacker can trigger phishing by supplying arbitrary websites in the rframe parameter. The exploit details and exact impact are described only as phishing via rframe; no further root-cause specifics or af...

CVE-2006-0792

Cross-site scripting XSS vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0792

CVE-2006-0792 : The vulnerability affects V-webmail 1.6.2 in the page preferences.personal.php where the newid parameter can be exploited to inject arbitrary web script or HTML (reflected XSS). This is a client-side script injection issue that could allow an attacker to execute JavaScript in the ...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

[SA18776] V-webmail Cross-Site Scripting and Path Disclosure

TITLE: V-webmail Cross-Site Scripting and Path Disclosure SECUNIA ADVISORY ID: SA18776 VERIFY ADVISORY: http://secunia.com/advisories/18776/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Exposure of system information WHERE: From remote SOFTWARE: V-webmail 1.x...

V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities

V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/16706/info V-webmail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage these...

V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/16706/info V-webmail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in the browser of an...

NeoMail neomail.pl sort Parameter XSS

The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sort' parameter in the 'neomail.pl' script before using it to generate dynamic content. An attacker may be able to exploit this issue to inject...

NeoMail Session ID Weakness neomail-prefs.pl Arbitrary Mail-folder Manipulation

The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sessionid' parameter in the 'neomail-prefs.pl' script as a valid session identifier. An unauthenticated attacker may be able to exploit this issue ...

EveryoneXSS.txt

Title: Everyone's loginName variable Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk Published: 12 february 2006 MorX Security Research Team http://www.morx.org Service: Webmail Vendor: everyone / www.everyone.net Vulnerability: Cross Site Scripting Exploit included: Yes Details:...

MailEnable Webmail Malformed Quoted-printable Email DoS (CVE-2006-0504)

The remote host is running MailEnable, a commercial mail server for Windows. According to its banner, using the webmail service bundled with the version of MailEnable Enterprise Edition on the remote host to view specially-formatted quoted-printable messages reportedly may result in 100% CPU...

neomailXSS.txt

Title: Neomail Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk Discovered: 24 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Webmail Perl Client Vendor: neomail / www.neocodesolutions.com Vulnerability: Cross Site Scripting / Cookie-The...

[SA18646] @Mail Webmail Attachment Upload Directory Traversal

TITLE: @Mail Webmail Attachment Upload Directory Traversal SECUNIA ADVISORY ID: SA18646 VERIFY ADVISORY: http://secunia.com/advisories/18646/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: @Mail 4.x http://secunia.com/product/5459/ DESCRIPTION: Secunia Research h...

[Full-disclosure] Outblaze Cross Site Scripting Vulnerability

Title: outblaze Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk simoatmorxorg Discovered: 23 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Webmail manager Vendor: outblaze / www.outblaze.com Vulnerability: Cross Site Scripting /...

[Full-disclosure] Neomail Cross Site Scripting Vulnerability

Title: Neomail Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk simoatmorxorg Discovered: 24 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Webmail Perl Client Vendor: neomail / www.neocodesolutions.com Vulnerability: Cross Site Scriptin...

CVE-2006-0504

Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service CPU utilization by viewing "formatted quoted-printable emails" via webmail...