Code injection

config/configinc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SGHOME parameter...

CVE-2006-1031

CVE-2006-1031 affects iGENUS Webmail 2.02 and earlier. The vulnerability allows a remote attacker to include arbitrary local files via the SG_HOME parameter in config/config_inc.php. This can impact confidentiality, integrity, and availability (partial). The NVD entry lists a base CVSS v2 score o...

CVE-2006-1031

config/configinc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SGHOME parameter...

CVE-2006-1031: Improper Control of Generation of Code

config/configinc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SGHOME parameter...

CVE-2006-0930

Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. dot dot in the UIDL parameter...

CVE-2006-0930

Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. dot dot in the UIDL parameter...

[ MDKSA-2006:049 ] - Updated squirrelmail packages fix vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:049 http://www.mandriva.com/security/ Package : squirrelmail Date : February 27, 2006 Affected: Corporate 3.0 Problem Description: Webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject...

[SA19036] iGENUS Webmail File Inclusion Vulnerability

TITLE: iGENUS Webmail File Inclusion Vulnerability SECUNIA ADVISORY ID: SA19036 VERIFY ADVISORY: http://secunia.com/advisories/19036/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: iGENUS Webmail 2.x http://secunia.com/product/8368/ DESCRIPTIO...

CVE-2006-0930: Undefined Security Weakness

Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. dot dot in the UIDL parameter...

noccw_10_incl_xpl.txt

------ NOCC Webmail remote code execution / / cross site scripting / path disclosure -------------------------------------------------------------------------------- software: site: http://nocc.sourceforge.net/ description: "NOCC is a webmail client written in PHP. It provides webmail access to...

igenus_remote.txt

!/usr/bin/perl use IO::Socket; print "\r\n"; print "iGENUS WebMail works against PHP5 with registerglobals = On\r\n"; print " & allowurlfopen = On\r\n"; print "by rgod rgodautisticiorg\r\n"; print "site: http://retrogod.altervista.org\r\n\r\n"; print "dork: intitle:"igenus webmail login"\r\n";...

CVE-2006-0891

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. dot dot sequences and a trailing NULL %00 byte in 1 the SESSION'nocctheme' parameter in a html/footer.php; and 2 the lang and 3 theme parameters and the 4 Accept-Language HTTP...

CVE-2006-0892

NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities...

CVE-2006-0894

Multiple cross-site scripting XSS vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the htmlerroroccurred parameter in error.php, 2 htmlfilterselect parameter in filterprefs.php, 3 htmlnomail parameter in nomail.php, the 4 pageline, 5 prev, an...

CVE-2006-0895

NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php...

CVE-2006-0893

NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to 1 the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and 2 the tmp directory, which lists names of uploaded attachments...

Directory traversal

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. dot dot sequences and a trailing NULL %00 byte in 1 the SESSION'nocctheme' parameter in a html/footer.php; and 2 the lang and 3 theme parameters and the 4 Accept-Language HTTP...

Directory traversal

NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities...

Information disclosure

NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to 1 the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and 2 the tmp directory, which lists names of uploaded attachments...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the htmlerroroccurred parameter in error.php, 2 htmlfilterselect parameter in filterprefs.php, 3 htmlnomail parameter in nomail.php, the 4 pageline, 5 prev, an...