CVE-2002-1526: Undefined Security Weakness

Cross-site scripting XSS vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via the email address field...

Outblaze Webmail - Cookie Authentication Bypass

Outblaze Webmail - Cookie Authentication Bypass // source: https://www.securityfocus.com/bid/7115/info Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability. This issue may allow a malicious attacker to bypass the cookie-based authentication mechanis...

Outblaze Webmail - Cookie Authentication Bypass

// source: https://www.securityfocus.com/bid/7115/info Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability. This issue may allow a malicious attacker to bypass the cookie-based authentication mechanisms used by the affected Outblaze web mail server...

php-nuke again ...

-----BEGIN PGP SIGNED MESSAGE----- I. BACKGROUND PHP-Nuke is a popular Web portal system. Project homepage : http://www.phpnuke.org II. DESCRIPTION Remote attacker could transfer to server his own file or copy arbitrary file from system to accessible directory. The result of such acts could be...

CVE-2002-2410

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information...

CVE-2002-2165

The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox...

CVE-2002-1708

Cross-site scripting vulnerability XSS in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the 1 subject or 2 message fields...

CVE-2002-1709

SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable...

CVE-2002-1710

The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file...

CVE-2002-1385

openwebmailinit in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. dot dot sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be...

Captaris (Infinite) WebMail XSS

I figured it was about time I hopped on the XSS band-wagon. Captaris www.captaris.com Infinite WebMail application is vulnerable to Cross-Site Scripting XSS attacks. The application fails to filter the following tags that can both be used to redirect a user to an attack script: Launch on e-mail...

Captaris Infinite WebMail 3.61.5 - HTML Injection

Captaris Infinite WebMail 3.61.5 - HTML Injection source: https://www.securityfocus.com/bid/6411/info An HTML injection vulnerability has been discovered in Captaris Infinite WebMail. Due to insufficient sanitization of HTML content, it is possible for an attacker to embed malicious script code...

Captaris Infinite WebMail 3.61.5 - HTML Injection

source: https://www.securityfocus.com/bid/6411/info An HTML injection vulnerability has been discovered in Captaris Infinite WebMail. Due to insufficient sanitization of HTML content, it is possible for an attacker to embed malicious script code into HTML email messages. This may allow an attacke...

Open WebMail 1.71 "background" magic info

Hello Folks, Open Webmail is a perl webmail program that runs on UNIX operational systems. For more about Open WebMail, its official website is http://openwebmail.org/. Ok, lets talk about the problem. Ive tested Open WebMail 1.71 an when you enter an invalid username user that doesnt exist on th...

XSS-Cookie-Advisory.txt

------------------------------------------------------- XSS/Cookie problems at major webmail sites Advisory ------------------------------------------------------- XSS/Cookie problems at major webmail sites 13/11/02 - by "N|ghtHawk" Thijs Bosschert nighthawkathackers4hackers.org...

IceWarp 3.4.5 XSS *AGAIN*

DarC KonQuesT IceWarp 3.4.5 XSS Release Product: IceWarp Webmail 3.4.5 Vendor: IceWarp Software - E-mail: [email protected] Web: www.icewarp.com Problem: Cross Site Scripting Severity: Mild Operating Systems: Tested against Win2k Discovered: October 29, 2002 Vendor Notified: October 29, 2002 Publi...

KMMail 1.0 - E-Mail HTML Injection

source: https://www.securityfocus.com/bid/6013/info kmMail does not sufficiently sanitize HTML and script code from the body of e-mail messages. As a result, an attacker may send a malicious message to a user of kmMail that includes arbitrary HTML and script code. This may allow an attacker to...

Crossitescripting in Argosoft Mail Server Pro

Crossite scripting in WebMail, cleartext passwords in cookie :...

CVE-2002-1004

Directory traversal vulnerability in webmail feature of ArGoSoft Mail Server Plus or Pro 1.8.1.5 and earlier allows remote attackers to read arbitrary files via .. dot dot sequences in a URL...

IIL Advisory: Format String bug in Null Webmail (0.6.3)

Illegal Instruction Labs Advisory ------------------------------------------------------------------------- Advisory name: Format String bug in Null Webmail 0.6.3 Advisory number: 7 Application: Null Webmail 0.6.3 Author: Dan Cahill E-mail: [email protected] Homepage:...