5061 matches found
PT-2019-12017
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.10 Description The issue allows an attacker with S/MIME or PGP encrypted emails to craft a multipart email, hiding the encrypted parts using HTML/CSS or ASCII newline characters. When the receiver replie...
CVE-2019-10740: Cleartext Transmission of Sensitive Information
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the...
PT-2019-2930
Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail versions 5.2.17 through 5.2.22 Description A remote code execution issue was discovered, related to the handling of image uploads in forms. The Horde Form Type image class in Horde/Form/Type.php contains a vulnerability...
Horde Form File Upload Vulnerability
Horde Groupware Webmail contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. The exploitation requires the Turba subcomponent to be installed. This module was tested on Horde versions 5.2.22 and 5.2.17 running Horde Form subcomponent use...
CVE-2019-9558
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...
CVE-2019-9558
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...
Cross site scripting
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...
CVE-2019-9558
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...
CVE-2019-9558
Mailtraq WebMail 2.17.7.3550 is affected by a Persistent Cross Site Scripting (XSS) vulnerability that can be triggered when a user opens an email containing malicious Javascript inserted as an iframe in the email body. The issue is server-side processing of email content that leads to XSS, enabl...
CVE-2019-9558: Improper Neutralization of Input During Web Page Generation
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...
PT-2019-19709
Name of the Vulnerable Software and Affected Versions Mailtraq WebMail version 2.17.7.3550 Description The issue allows for Persistent Cross Site Scripting XSS via the body of an e-mail message. To exploit this, the victim must open an email with malicious Javascript inserted into the body of the...
Mailtraq WebMail 2.17.7.3550 Cross Site Scripting
Exploit Title: Persistent Cross Site Scripting XSS - Mailtraq WebMail version 2.17.7.3550 CVE: CVE-2019-9558 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://www.mailtraq.com/mail-server-software Category: webapps Attack Type: Remote Impact:...
CVE-2019-8983
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...
CVE-2019-8984
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...
CVE-2019-8984
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...
CVE-2019-8983
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...
Cross site scripting
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...
Cross site scripting
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...
CVE-2019-8983
MDaemon Webmail 14.x–18.x prior to 18.5.2 is affected by a cross-site scripting (XSS) vulnerability in the Webmail interface (described as issue 1 of 2). Root cause details are not explicitly provided in the supplied sources. Mitigation: upgrade to 18.5.2 or later (as implied by the fixed version...