MailBee WebMail Pro 'download_view_attachment.aspx'本地文件包含漏洞

MailBee WebMail Pro是一款基于ASPX的WEB应用程序。 MailBee WebMail Pro不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'downloadviewattachment.aspx'脚本对用户提交的'tempfilename'参数处理缺少充分过滤，提交多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容. AfterLogic MailBee WebMail Pro 厂商解决方案 目前没有解决方案提供： http://www.afterlogic.com/...

Directory traversal

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

Directory traversal vulnerability in downloadviewattachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the tempfilename parameter...

CVE-2008-0333

The CVE-2008-0333 issue concerns AfterLogic MailBee WebMail Pro for ASP.NET (version 4.1) where a directory traversal flaw in download_view_attachment.aspx allows reading arbitrary files via .. in the temp_filename parameter. Root cause: unvalidated input in the downloadViewAttachment endpoint en...

MailBee WebMail Pro 4.1 (ASP.NET) Remote File Disclosure Vulnerability

No description provided by source. homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=-...

Debian Security Advisory DSA 988-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 988-1. Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-0188 Martijn Brinkers a...

Debian: Security Advisory (DSA-988-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-756-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-662-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

mailbee-rfd.txt

homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=-...

PT-2008-1966 · Afterlogic +1 · Afterlogic Mailbee Webmail Pro +1

Name of the Vulnerable Software and Affected Versions: AfterLogic MailBee WebMail Pro version 4.1 for ASP.NET Description: The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the download view attachment.aspx file. This is achieved by using a...

Debian Security Advisory DSA 1241-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 1241-1. Martijn Brinkers discovered cross-site scripting vulnerabilities in the the mailto parameter of webmail.php, the session and deletedraft parameters of compose.php and through a shortcoming in the magicHTML...

Debian Security Advisory DSA 1290-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 1290-1. OpenVAS Vulnerability Test $Id: deb12901.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1290-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 220-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 220-1. OpenVAS Vulnerability Test $Id: deb2201.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 220-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

MailBee WebMail Pro 4.1 (ASP.NET) Remote File Disclosure Vulnerability

Exploit for unknown platform in category web applications ====================================================================== MailBee WebMail Pro 4.1 ASP.NET Remote File Disclosure Vulnerability ====================================================================== homepage: www.afterlogic.com...

MailBee WebMail Pro 4.1 - Remote File Disclosure

MailBee WebMail Pro 4.1 - Remote File Disclosure homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=- milw0rm.com 2008-01-16...

MailBee WebMail Pro 4.1 - Remote File Disclosure

homepage: www.afterlogic.com example: http://www.xxx.com/webmail-pro-net/downloadviewattachment.aspx?tempfilename=../../../../../../../../../../../../../../../../../../boot.ini -=M.o.B=- milw0rm.com 2008-01-16...

Horde IMP及Groupware Webmail Edition多个输入验证漏洞

BUGTRAQ ID: 27223 CVECAN ID: CVE-2007-6018 IMP是一款基于Web的强大的邮件程序，它由Horde项目组开发。可使用在Linux/Unix或者Microsoft Windows操作系统下。 IMP在处理HTML的数据时存在漏洞，远程攻击者可能利用此漏洞非授权操作邮件。 IMP Webmail客户端和Groupware Webmail Edition的HTML过滤器没有过滤掉frame和frameset...

Design/Logic Flaw

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to 1 delete arbitrary e-mail messages via a modified numeric ID or 2 "purge" deleted emails via a crafted email message...