CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2005-1435
https://notcve.org/view.php?id=CVE-2005-1435
Open WebMail (OWM) before 2.51 20050430 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename. • http://secunia.com/advisories/15225 http://securitytracker.com/id?1013859 http://sourceforge.net/forum/message.php?msg_id=3128678 •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2005-0445
https://notcve.org/view.php?id=CVE-2005-0445
Cross-site scripting (XSS) vulnerability in Open WebMail 2.x allows remote attackers to inject arbitrary HTML or web script via the domain name parameter (logindomain) in the login page. • http://secunia.com/advisories/14253 http://securitytracker.com/id?1013172 http://turtle.ee.ncku.edu.tw/openwebmail/doc/changes.txt http://turtle.ee.ncku.edu.tw/openwebmail/download/cert/patches/SA-05:01/2.5x.patch http://www.securityfocus.com/bid/12547 https://exchange.xforce.ibmcloud.com/vulnerabilities/19335 •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2004-2458
https://notcve.org/view.php?id=CVE-2004-2458
Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories. • http://openwebmail.org/openwebmail/download/cert/patches/SA-04:02/openwebmail.pl.patch http://secunia.com/advisories/11334 http://www.securityfocus.com/bid/10087 https://exchange.xforce.ibmcloud.com/vulnerabilities/15822 •
CVSS: 10.0EPSS: 2%CPEs: 10EXPL: 0CVE-2004-2284
https://notcve.org/view.php?id=CVE-2004-2284
The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument. • http://openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt http://secunia.com/advisories/12017 http://securitytracker.com/id?1010605 http://www.osvdb.org/7474 http://www.securityfocus.com/bid/10637 https://exchange.xforce.ibmcloud.com/vulnerabilities/16549 •
CVSS: 6.8EPSS: 3%CPEs: 21EXPL: 2CVE-2004-0639 – SquirrelMail 1.2.x - From Email Header HTML Injection
https://notcve.org/view.php?id=CVE-2004-0639
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados en Squirrelmail 1.2.10 y anteriores permiten a atacantes remotos inyectar HTML o script de su elección mediante (1) la variable $mailer en read_body.php, (2) la variable $senderNames_part en mailbox_display.php, y posiblemente otros vectores,incluyendo (3) la variable $event_text. • https://www.exploit-db.com/exploits/24167 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 http://marc.info/?l=bugtraq&m=108611554415078&w=2 http://www.debian.org/security/2004/dsa-535 http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt http://www.securityfocus.com/bid/10450 https://exchange.xforce.ibmcloud.com/vulnerabilities/16285 •