CVSS: 8.8EPSS: 0%CPEs: 91EXPL: 0CVE-2010-4554 – SquirrelMail: Prone to clickjacking attacks
https://notcve.org/view.php?id=CVE-2010-4554
14 Jul 2011 — functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. functions/page_header.php en SquirrelMail v1.4.21 y anteriores no previene el renderizado de páginas dentro de un marco en un documento HTML de terceros, haciéndolo más fácil a atacantes remotos para realizar ataques de clickjacking mediante un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 91EXPL: 0CVE-2010-4555 – SquirrelMail: Multiple XSS flaws
https://notcve.org/view.php?id=CVE-2010-4555
14 Jul 2011 — Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka options_order) page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail v1.4.21 y anteriores, permite a atacantes remotos in... • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 54EXPL: 0CVE-2010-2813 – SquirrelMail: DoS (disk space consumption) by random IMAP login attempts with 8-bit characters in the password
https://notcve.org/view.php?id=CVE-2010-2813
19 Aug 2010 — functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files. functions/imap_general.php en SquirrelMail anterior a v1.4.21 no maneja adecuadamente los caracteres de 8-bits en contraseñas, lo cual permite a atacantes remotos causar una denegación de servicio (consumo de ... • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2010-1637 – SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
https://notcve.org/view.php?id=CVE-2010-1637
22 Jun 2010 — The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number. El plugin Mail Fetch en SquirrelMail 1.4.20 y versiones anteriores, permite a atacantes remotos autenticados eludir las restricciones del firewall y usar SquirrelMail como un proxy para escanear redes internas mediante un número de puerto POP3 modificado. • http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 86EXPL: 0CVE-2009-2964 – squirrelmail: CSRF issues in all forms
https://notcve.org/view.php?id=CVE-2009-2964
25 Aug 2009 — Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_get... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 72EXPL: 0CVE-2009-1580 – SquirrelMail: Session fixation vulnerability
https://notcve.org/view.php?id=CVE-2009-1580
14 May 2009 — Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie. Vulnerabilidad de fijación de sesión en SquirrelMail versiones anteriores a v1.4.18 permite a atacantes remotos secuestrar sesiones web a través de una cookie manipulada. • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-287: Improper Authentication CWE-384: Session Fixation •
CVSS: 6.8EPSS: 3%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
05 Dec 2006 — Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de com... • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc •
CVSS: 9.1EPSS: 26%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
11 Aug 2006 — Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3174
https://notcve.org/view.php?id=CVE-2006-3174
23 Jun 2006 — Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter. • http://docs.info.apple.com/article.html?artnum=306172 •
CVSS: 6.1EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0188
https://notcve.org/view.php?id=CVE-2006-0188
24 Feb 2006 — webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc •