CVE-2015-1503

CVE-2015-1503 affects IceWarp Mail Server versions prior to 11.2. A directory traversal vulnerability exists in the web interface: an attacker can read arbitrary server files via directory traversal sequences (.. and .../.. etc) in parameters to webmail/client/skins/default/css/css.php and to web...

IceWarp Mail Server 11.1.1 - Directory Traversal

IceWarp Mail Server 11.1.1 - Directory Traversal Vendor: IceWarp http://www.icewarp.com Product: IceWarp Mail Server Version affected: 11.1.1 and below Product description: IceWarp WebMail provides web-based access to email, calendars, contacts, files and shared data from any computer with a...

IceWarp Mail Server < 11.1.1 - Directory Traversal

Vendor: IceWarp http://www.icewarp.com Product: IceWarp Mail Server Version affected: 11.1.1 and below Product description: IceWarp WebMail provides web-based access to email, calendars, contacts, files and shared data from any computer with a browser and Internet connection. IceWarp Mail Server ...

Debian DSA-4181-1 : roundcube - security update

Andrea Basile discovered that the 'archive' plugin in roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize a user-controlled parameter, allowing a remote attacker to inject arbitrary IMAP commands and perform malicious actions. C Tenable Network Security...

[SECURITY] Fedora 28 Update: roundcubemail-1.3.6-1.fc28

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 27 Update: roundcubemail-1.3.6-1.fc27

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 26 Update: roundcubemail-1.3.6-1.fc26

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] [DLA 1344-1] squirrelmail security update

Package : squirrelmail Version : 2:1.4.23svn20120406-2+deb7u2 CVE ID : CVE-2018-8741 Debian Bug : 893202 Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrar...

Roundcube Webmail 1.2.0 - 1.3.5 MX Injection Vulnerability

Roundcube Webmail is prone to an injection vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

[SECURITY] [DSA 4168-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4168-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2018 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4168-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

iRedMail Information Disclosure Vulnerability

iRedMail is an open source e-mail server solution . Roundcube Webmail is one of the browser-based mail client . A security vulnerability exists in Roundcube Webmail in previous versions of iRedMail commit f04b8ef. A remote attacker could exploit the vulnerability by sending a specially crafted...

webmail.task.com.br XSS vulnerability

Open Bug Bounty ID: OBB-581098 Description| Value ---|--- Affected Website:| webmail.task.com.br Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

Design/Logic Flaw

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

CVE-2018-1000072 affects iRedMail prior to commit f04b8ef, where the Roundcube Webmail component contains an insecure permissions flaw that can lead to exfiltration of sensitive data, including a user’s secret GPG key and other configuration files, via network access. The issue is documented acro...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2012-3536

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was...

CVE-2012-3536

Two XSS vulnerabilities were fixed in Hupa Webmail (Apache James project) affecting the message list and message view. An attacker could exploit by sending a crafted email that triggers XSS when opened or when the message list is viewed. The issue is reported as addressed in Hupa 0.0.3. No exploi...