CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

CVE-2013-1904

Roundcube Webmail versions before 0.7.3 and 0.8.x before 0.8.6 are vulnerable to an absolute path traversal (also described as a local file inclusion ) vulnerability in the steps/mail/sendmail.inc component. The root cause is insufficient validation of the _value parameter for the generic_message...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

PT-2014-2518

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.7.3 Roundcube Webmail versions 0.8.x prior to 0.8.6 Description The issue allows remote attackers to read arbitrary files via a full pathname in the value parameter for the generic message footer setting i...

CVE-2013-1904: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

Atmail WebMail 7.0.2 Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2013-014 - Original release date: March 25th, 2013 - Last revised: March 25th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 4.3/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6229...

VulnCheck KEV: CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

Ability Mail Server 2013 - Password Reset CSRF from Stored XSS (Web UI)

Exploit for windows platform in category web applications On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a use...

Ability Mail Server 2013 -Persistent Cross-Site Scripting Cross-Site Request Forgery (Password Reset)

Ability Mail Server 2013 -Persistent Cross-Site Scripting Cross-Site Request Forgery Password Reset On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and...

Ability Mail Server 2013 -Persistent Cross-Site Scripting / Cross-Site Request Forgery (Password Reset)

On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a user named, victim, with a password of victim 5. Finish...

AfterLogic Pro and Lite 7.1.1.1存储型跨站脚本漏洞

No description provided by source. ?php / Exploit Title : AfterLogic Pro and Lite = 7.1.1.1 Stored XSS Google Dork : intext:"AfterLogic" intext:"Login Information" inurl:index.php Date : 19 Jan 2014 Exploit Author : Saeed reza Zamanian s.zamanian AT imenantivirus.com Vendor Homepage:...

AfterLogic Pro and Lite 7.1.1.1 - Persistent Cross-Site Scripting

AfterLogic Pro and Lite 7.1.1.1 - Persistent Cross-Site Scripting Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/AfterLogic/Default.aspx Phpmailer class is included in the exploit so you nee...

AfterLogic Pro and Lite <= 7.1.1.1 Stored XSS Vulnerability

XSS codes can be stored in E-Mail Body. So you can send an email to the Victim with below payload and steal the victim's cookie. Usage Info Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer directory:...

AfterLogic Pro / Lite 7.1.1.1 Cross Site Scripting

Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/AfterLogic/Default.aspx Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer...

Atmail Webmail Server - Email Body HTML Injection

Atmail Webmail Server - Email Body HTML Injection source: https://www.securityfocus.com/bid/64779/info Atmail Webmail Server is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentiall...

Atmail Webmail Server - Email Body HTML Injection

source: https://www.securityfocus.com/bid/64779/info Atmail Webmail Server is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

CVE-2013-6017

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...