Design/Logic Flaw

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter...

CVE-2017-7855

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter...

CVE-2017-7855

IceWarp WebMail 11.3.1.5 is affected by a Cross-Site Scripting (XSS) vulnerability in the language parameter of the webmail component. The Nuclei template confirms the affected product/version and states that an attacker can execute arbitrary JavaScript in a victim’s browser, potentially stealing...

CVE-2017-7855: Improper Neutralization of Input During Web Page Generation

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter...

PT-2017-17957

Name of the Vulnerable Software and Affected Versions IceWarp Server version 11.3.1.5 Description A security issue was found in the webmail component, specifically an XSS vulnerability related to the language parameter. Recommendations For IceWarp Server version 11.3.1.5, avoid using the language...

IceWarp Mail Server Detection (HTTP)

HTTP based detection of IceWarp Mail Server. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Legal Robot: Information Discloser

Affected Url: https://webmail.legalrobot-uat.com/" When i Open This Link Then It Gives An Error In Which information is disclosing about your server type and its version and Os of your server and also port no is shown which is using on your server and open For Proof i am attaching Screenshot...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2017-18573)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in Roundcube Webmail version 1.1.5. A remote attacker can exploit this vulnerability to execute JavaScript...

atmail Cross-Site Scripting Vulnerability

atmail is an open source WebMail client from Australia's atmail company , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site scripting vulnerability exists in versions of atmail prior to 7.8.0.2. A...

CopyKittens Exposed by ClearSky and Trend Micro

CopyKittens is a cyberespionage group that ClearSky has been reporting on since 2015, tracking their attacks on government-related bodies around the world. Trend Micro has supported this research at several points, including for their latest report released today on the group’s vast espionage...

Fedora 26 : roundcubemail (2017-7263e7d321)

Roundcube Webmail 1.2.5 This is a security update to the stable version 1.2. It primarily fixes a recently discovered vulnerability in the virtualmin and sasl drivers of the password plugin plus adds a few cherry-picked bug fixes from upstream versions. A detailed list of changes is shown below...

Vodafone Italia Webmail Cross Site Scripting

Title: Vodafone Webmail - Stored Cross-Site Scripting Date: 2017-07-14 Exploit Author: theMiddle / https://github.com/theMiddleBlue Website: https://web.mail.vodafone.it 1. Description the Vodafone Italia webmail web.mail.vodafone.it suffers from a stored cross-site scripting vulnerability. The...

RoundCube: Security bypass

Background Free and open source webmail software for the masses, written in PHP. Description Authenticated users can arbitrarily reset passwords due to a problem caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Impact Authenticated users can...

webmail.bait.net.pl Open Redirect vulnerability

Vulnerable URL: http://webmail.bait.net.pl/horde/util/go.php?url=https://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 21.09.2017 Latest check for patch:| 21.09.2017 13:57 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknow...

AtMail Cross-Site Request Forgery Vulnerability (CNVD-2017-09349)

AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in Atmail versions prior to 7.8.0.2...

[SECURITY] Fedora 26 Update: squirrelmail-1.4.22-19.fc26

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

hosting24.com XSS vulnerability

Vulnerable URL: https://www.hosting24.com/webmaillogin.php?action=login Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 85113 VIP website status:| Yes Coordinated Disclosure Timelin...

[SECURITY] Fedora 25 Update: squirrelmail-1.4.22-19.fc25

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

[SECURITY] Fedora 24 Update: squirrelmail-1.4.22-19.fc24

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Roundcube Webmail < 1.0.6, 1.1.x < 1.1.2 Multiple Vulnerabilities

Roundcube Webmail is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...