BasiliX Webmail 1.1 - Email Header HTML Injection

BasiliX Webmail 1.1 - Email Header HTML Injection source: https://www.securityfocus.com/bid/10662/info BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings...

BasiliX Webmail 1.1 - Email Header HTML Injection

source: https://www.securityfocus.com/bid/10662/info BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain acces...

Squirrelmail: Another XSS vulnerability

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description A new cross-site scripting XSS vulnerability in Squirrelmail-1.4.3rc1 has been discovered. In functions/mime.php Squirrelmail fails to properly...

Open WebMail Multiple Content Header XSS

The target is running at least one instance of Open WebMail whose version is 2.32 or earlier. Such versions are vulnerable to a cross- site scripting attack whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code by reading a MIME message with a specially crafted...

NetWin Surgemail 1.81.92.0 WebMail 3.1 - Login Form Cross-Site Scripting

NetWin Surgemail 1.81.92.0 WebMail 3.1 - Login Form Cross-Site Scripting source: https://www.securityfocus.com/bid/10483/info SurgeMail/WebMail is prone to multiple vulnerabilities. These issue result from insufficient sanitization of user-supplied data. The issues can allow an attacker to carry...

NetWin Surgemail 1.81.92.0 WebMail 3.1 - Error Message Full Path Disclosure

NetWin Surgemail 1.81.92.0 WebMail 3.1 - Error Message Full Path Disclosure source: https://www.securityfocus.com/bid/10483/info SurgeMail/WebMail is prone to multiple vulnerabilities. These issue result from insufficient sanitization of user-supplied data. The issues can allow an attacker to car...

NetWin Surgemail 1.8/1.9/2.0 / WebMail 3.1 - Error Message Full Path Disclosure

source: https://www.securityfocus.com/bid/10483/info SurgeMail/WebMail is prone to multiple vulnerabilities. These issue result from insufficient sanitization of user-supplied data. The issues can allow an attacker to carry out path disclosure and cross-site scripting attacks. SurgeMail versions...

NetWin Surgemail 1.8/1.9/2.0 / WebMail 3.1 - Login Form Cross-Site Scripting

source: https://www.securityfocus.com/bid/10483/info SurgeMail/WebMail is prone to multiple vulnerabilities. These issue result from insufficient sanitization of user-supplied data. The issues can allow an attacker to carry out path disclosure and cross-site scripting attacks. SurgeMail versions...

"Content-Type" XSS vulnerability affecting other webmail systems

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results...

Multiple XSS Vulnerabilities in SquirrelMail

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description Several unspecified cross-site scripting XSS vulnerabilities and a well hidden SQL injection vulnerability were found. An XSS attack allows an...

[Full-Disclosure] CSA-200402-1: Previous Open Webmail vulnerability is exploitable

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cycom AB Security Advisory CSA-200402-1 www.cycom.se Advisory: Previous Open Webmail vulnerability is exploitable Date: Sat Feb 21 15:18:21 CET 2004, updated: Thu May 6 10:37:29 CEST 2004 Application: Open Webmail 2.20, 2.21 and 2.30 and -current...

Open WebMail 1.x2.x - Remote Command Execution Variant

Open WebMail 1.x2.x - Remote Command Execution Variant source: https://www.securityfocus.com/bid/10316/info A vulnerability has been reported in Open WebMail that allows a remote attacker to execute arbitrary commands on a vulnerable host. The problem is due to insufficient sanitization of shell...

Open WebMail 1.x/2.x - Remote Command Execution Variant

source: https://www.securityfocus.com/bid/10316/info A vulnerability has been reported in Open WebMail that allows a remote attacker to execute arbitrary commands on a vulnerable host. The problem is due to insufficient sanitization of shell metacharacters that are passed to the vulnerable softwa...

CVE-2004-1993

The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "" backticks in the password...

DEBIAN-CVE-2004-0224

Multiple buffer overflows in 1 iso2022jp.c or 2 shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code "when Unicode character is out of BMP range."...

Centrinity FirstClass HTTP Server 57 - TargetName Cross-Site Scripting

Centrinity FirstClass HTTP Server 57 - TargetName Cross-Site Scripting source: https://www.securityfocus.com/bid/9950/info It has been reported that FirstClass HTTP Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script cod...

Centrinity FirstClass HTTP Server 5/7 - 'TargetName' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9950/info It has been reported that FirstClass HTTP Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in a user's browser. The issue presents itself due to insufficient...

Emumail WebMail Multiple Remote Vulnerabilities (XSS, Disc)

According to its version number, the remote host is running a vulnerable version of EMUMAIL WebMail. There are several vulnerabilities in this version, ranging from information disclosure to cross-site scripting vulnerabilities. These issues may allow an attacker to trick a logged-in user into...

Emumail EMU Webmail 5.2.7 - nit.emu Information Disclosure

Emumail EMU Webmail 5.2.7 - nit.emu Information Disclosure source: https://www.securityfocus.com/bid/9861/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out cross-site scripting attacks and disclose the path to the victim's home directory...

Emumail EMU Webmail 5.2.7 - emumail.fcgi Multiple Cross-Site Scripting Vulnerabilities

Emumail EMU Webmail 5.2.7 - emumail.fcgi Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/9861/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out cross-site scripting attacks and disclose the path to...