Atmail WebMail <= 5.6.1 (5.61) webadmin/admin.php Multiple Parameter XSS

The version of Atmail WebMail running on the remote host is vulnerable to multiple cross-site scripting issues. 'webadmin/admin.php' fails to sanitize input to the 'func' parameter, and to the 'type' parameter when 'func' is set to 'stats'. This is known to affect version 5.6.1 5.61 and may affec...

Atmail WebMail <= 5.6.0 (5.60) Email Body Injection

The version of Atmail WebMail running on the remote host is vulnerable to an email body injection attack. HTML and script code are not properly sanitized before it is displayed in dynamically generated content. This vulnerability is known to affect versions 5.6.0 5.60 and earlier. A remote attack...

Atmail Webmail / AtmailOpen Webmail Detection

Atmail Webmail or AtmailOpen Webmail is installed on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid38648; scriptversion"1.18"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Atmail Webmail /...

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode() Buffer Overflow (PoC)

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode Buffer Overflow PoC "cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt...

Icewarp Merak Mail Server 9.4.1 Base64FileEncode() BOF PoC

Exploit for unknown platform in category dos / poc ========================================================== Icewarp Merak Mail Server 9.4.1 Base64FileEncode BOF PoC ========================================================== "cgi-fcgi" die"Launch from the merak php console!"; if...

Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)

"cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt "\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53". "\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3...

FreeBSD : 'Content-Type' XSS vulnerability affecting other webmail systems (c5519420-cec2-11d8-8898-000d6111a684)

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Atmail WebMail Email Body HTML Injection Vulnerability

Atmail and Atmail WebMail are prone to an HTML-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in dynamically generated content. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced...

Debian Security Advisory DSA 1770-1 (imp4)

The remote host is missing an update to imp4 announced via advisory DSA 1770-1. OpenVAS Vulnerability Test $Id: deb17701.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1770-1 imp4 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Debian DSA-1770-1 : imp4 - Insufficient input sanitising

Several vulnerabilities have been found in imp4, a webmail component for the horde framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-4182 It was discovered that imp4 suffers from a cross-site scripting XSS attack via the user field in an IM...

[SECURITY] [DSA 1770-1] New imp4 packages fix cross-site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1770-1 [email protected] http://www.debian.org/security/ Steffen Joeris April 13, 2009 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1770-1] New imp4 packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1770-1 [email protected] http://www.debian.org/security/ Steffen Joeris April 13, 2009 http://www.debian.org/security/faq -...

DSA-1770-1 imp4 - cross-site scripting

Bulletin has no description...

FreeBSD Ports: roundcube

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : roundcube -- webmail script insertion and php code injection (35c0b572-125a-11de-a964-0030843d3802)

Secunia reports : Some vulnerabilities have been reported in RoundCube Webmail, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion attacks and compromise a vulnerable system. The HTML 'background' attribute within e.g...

The use of injection techniques to attack the mail server and defenses(a)-vulnerability warning-the black bar safety net

This article will detail through the talk to mail server communication of a Web application, i.e., the webmail application to inject some mail protocolsIMAP and SMTP Protocolcommands to attack a mail server of the principles, methods and defenses. A Webmail application role Webmail app through IM...

Fedora Update for squirrelmail FEDORA-2007-505

Check for the Version of squirrelmail OpenVAS Vulnerability Test Fedora Update for squirrelmail FEDORA-2007-505 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

SquirrelMail软件包会话处理绕过认证漏洞

BUGTRAQ ID: 33354 CVECAN ID: CVE-2009-0030 SquirrelMail是一款PHP编写的WEBMAIL程序。 Red Hat为CVE-2008-3663所提供的修复导致SquirrelMail对所有的会话都设置了相同的SQMSESSID Cookie值，这允许通过认证的远程用户通过使用标准的webmail.php接口访问其他用户的文件夹列表和配置数据。 SquirrelMail 1.4.8 厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2009:0057-01）以及相应补丁:...

Fedora Update for roundcubemail FEDORA-2008-5315

Check for the Version of roundcubemail OpenVAS Vulnerability Test Fedora Update for roundcubemail FEDORA-2008-5315 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for roundcubemail FEDORA-2008-5333

Check for the Version of roundcubemail OpenVAS Vulnerability Test Fedora Update for roundcubemail FEDORA-2008-5333 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...