VAMP Webmail 2.0beta1 - yesno.phtml Remote File Inclusion

VAMP Webmail 2.0beta1 - yesno.phtml Remote File Inclusion ToXiC VAMP Webmail Remote File Inclusion by ToXiC CreW BuG FounD by Drago84 Application Affect:VAMP Webmail Page: yesno.phtml Dir : /setup/ Problem: ExPloit :...

VAMP Webmail <= 2.0beta1 (yesno.phtml) Remote Include Vulnerability

No description provided by source. ToXiC VAMP Webmail Remote File Inclusion by ToXiC CreW BuG FounD by Drago84 Application Affect:VAMP Webmail Page: yesno.phtml Dir : /setup/ Problem: ?if$answer=="Yes" include $yesurl; else include $nourl; ? ExPloit :...

RHEL 3 / 4 : squirrelmail (RHSA-2006:0668)

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in...

CentOS 3 / 4 : squirrelmail (CESA-2006:0668)

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in...

squirrelmail security update

CentOS Errata and Security Advisory CESA-2006:0668 A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMai...

Moderate: Red Hat Security Advisory: squirrelmail security update

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in...

CVE-2006-4951

Neon WebMail for Java before 5.08 allows remote attackers to execute arbitrary Java JSP code by sending an e-mail message with a JSP file attachment, which is stored under the web root with a predictable filename...

CVE-2006-4954

The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the inid parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying 1 passwords and 2 permissions, 3 viewing profile settings, and 4 creating and 5 deleting users...

CVE-2006-4955

Directory traversal vulnerability in the downloadfile servlet in Neon WebMail for Java before 5.08 allows remote attackers to read arbitrary files via a .. dot dot sequence in the 1 savefolder and 2 savefilename parameters...

CVE-2006-4952

The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter...

CVE-2006-4953

Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the 1 adrsortkey and 2 adrsortkeydesc parameters in the a addrlist servlet, and the 3 sortkey and 4 sortkeydesc parameters in the b maillist servlet...

CVE-2006-4956

Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...

CVE-2006-4951

Neon WebMail for Java before 5.08 allows remote attackers to execute arbitrary Java JSP code by sending an e-mail message with a JSP file attachment, which is stored under the web root with a predictable filename...

CVE-2006-4954

The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the inid parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying 1 passwords and 2 permissions, 3 viewing profile settings, and 4 creating and 5 deleting users...

CVE-2006-4955

Directory traversal vulnerability in the downloadfile servlet in Neon WebMail for Java before 5.08 allows remote attackers to read arbitrary files via a .. dot dot sequence in the 1 savefolder and 2 savefilename parameters...

CVE-2006-4956

Neon WebMail for Java before 5.08 has a cross-site scripting (XSS) vulnerability in the updateuser servlet. The in_name parameter used for the Name field can be exploited to inject arbitrary script/HTML when the page is rendered. The flaw is documented under CVE-2006-4956 with consistent vendor r...

CVE-2006-4951

Neon WebMail for Java before 5.08 is vulnerable to remote code execution: an attacker can send an email containing a JSP attachment that is stored under the web root with a predictable filename, allowing execution of arbitrary Java (JSP) code on the server. The affected component is Neon WebMail ...

CVE-2006-4952

The CVE-2006-4952 entry concerns Neon WebMail for Java (pre-5.08) where the updatemail servlet allows remote attackers to move e-mail messages of arbitrary users between folders. The vulnerability is triggered via the ID parameter alongside folderid and tofolderid, enabling unauthorized relocatio...

CVE-2006-4955

CVE-2006-4955 concerns a directory traversal vulnerability in the Neon WebMail for Java downloadfile servlet. The flaw allows remote attackers to read arbitrary files via a .. sequence in the (1) savefolder and (2) savefilename parameters, affecting Neon WebMail for Java prior to version 5.08. Th...

CVE-2006-4953

Neon WebMail for Java before 5.08 is affected by multiple SQL injection vulnerabilities. The issues enable remote attackers to execute arbitrary SQL commands via parameters in two servlets: (1) addrlist (adr_sortkey and adr_sortkey_desc) and (2) maillist (sortkey and sortkey_desc). Root cause is ...