Cross site scripting

webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting XSS issue, but it is different than what is normally identified as XSS...

CVE-2006-0188

SquirrelMail webmail 1.4.0–1.4.5 is affected by CVE-2006-0188 (and related CVEs listed in advisory DSA-988-1/CESA-2006:0283), allowing remote attackers to inject arbitrary HTML via the right_frame parameter in webmail.php. Debian/Red Hat/CentOS advisories recommend upgrading to SquirrelMail 1.4.6...

NOCC Webmail <= 1.0 multiple vulnerabilities

------ NOCC Webmail = 1.0 multiple arbitrary local inclusion + ---------------- php injection - remote code execution / / cross site scripting / path disclosure -------------------------------------------------------------------------------- software: site: http://nocc.sourceforge.net/ descriptio...

NOCC 1.0 - no_mail.php?html_no_mail Cross-Site Scripting

NOCC 1.0 - nomail.php?htmlnomail Cross-Site Scripting source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit the...

NOCC Webmail 1.0 - Local File Inclusion Remote Code Execution

NOCC Webmail 1.0 - Local File Inclusion Remote Code Execution works regardless of any magicquotesgpc settings dork: "powered by nocc" intitle:"NOCC Webmail" -site:sourceforge.net -Zoekinalles.nl -analysis Sun-Tzu: "Knowing the place and the time of the coming battle, we may concentrate from the...

NOCC 1.0 - error.php?html_error_occurred Cross-Site Scripting

NOCC 1.0 - error.php?htmlerroroccurred Cross-Site Scripting source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can explo...

NOCC 1.0 - filter_prefs.php?html_filter_select Cross-Site Scripting

NOCC 1.0 - filterprefs.php?htmlfilterselect Cross-Site Scripting source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can...

NOCC 1.0 - 'no_mail.php?html_no_mail' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to inject arbitrary PHP code and execute it ...

NOCC Webmail 1.0 - Local File Inclusion / Remote Code Execution

works regardless of any magicquotesgpc settings dork: "powered by nocc" intitle:"NOCC Webmail" -site:sourceforge.net -Zoekinalles.nl -analysis Sun-Tzu: "Knowing the place and the time of the coming battle, we may concentrate from the greatest distances in order to fight" / short explaination: we...

NOCC 1.0 - 'error.php?html_error_occurred' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to inject arbitrary PHP code and execute it ...

NOCC 1.0 - 'filter_prefs.php?html_filter_select' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to inject arbitrary PHP code and execute it ...

CVE-2006-0792

Cross-site scripting XSS vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0793

frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Information disclosure

frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Design/Logic Flaw

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0792

CVE-2006-0792 : The vulnerability affects V-webmail 1.6.2 in the page preferences.personal.php where the newid parameter can be exploited to inject arbitrary web script or HTML (reflected XSS). This is a client-side script injection issue that could allow an attacker to execute JavaScript in the ...

CVE-2006-0793

CVE-2006-0793 concerns V-webmail 1.6.2. The vulnerability is in frameset.php, where a remote attacker can trigger phishing by supplying arbitrary websites in the rframe parameter. The exploit details and exact impact are described only as phishing via rframe; no further root-cause specifics or af...

CVE-2006-0794

CVE-2006-0794 affects V-webmail 1.6.2 via help.php, where remote attackers can obtain the installation path through unspecified invalid parameters. The available documents describe a path-disclosure issue but do not provide detailed root-cause analysis, exploited vectors, or concrete mitigation s...