CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2008-3663 – squirrelmail: session hijacking - secure flag not set for HTTPS-only cookies
https://notcve.org/view.php?id=CVE-2008-3663
24 Sep 2008 — Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. Squirrelmail 1.4.15 no establece la bandera de seguridad para la cookie de sesión en una sesión https, lo que podría provocar que la cookie pudiera ser enviada en peticiones http y facilitar a atacantes remotos capturar esta cookie. • http://int21.de/cve/CVE-2008-3663-squirrelmail.html • CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 3%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
05 Dec 2006 — Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de com... • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc •
CVSS: 9.1EPSS: 26%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
11 Aug 2006 — Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3174
https://notcve.org/view.php?id=CVE-2006-3174
23 Jun 2006 — Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter. • http://docs.info.apple.com/article.html?artnum=306172 •
CVSS: 6.1EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0188
https://notcve.org/view.php?id=CVE-2006-0188
24 Feb 2006 — webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc •
CVSS: 6.1EPSS: 2%CPEs: 12EXPL: 0CVE-2006-0195
https://notcve.org/view.php?id=CVE-2006-0195
24 Feb 2006 — Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0377
https://notcve.org/view.php?id=CVE-2006-0377
24 Feb 2006 — CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection." • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc •
CVSS: 6.1EPSS: 11%CPEs: 22EXPL: 1CVE-2005-2095 – SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2005-2095
13 Jul 2005 — options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files. options_identities.php en SquirrelMail 1.4.4 y anteriores usa la función "extract" para procesar la variable "$_POST", lo que permite que atacantes remotos modifiquen o lean las preferencias de otros usuarios, lleven a cabo ataques XSS o escriban ... • https://www.exploit-db.com/exploits/43830 •
CVSS: 6.1EPSS: 1%CPEs: 6EXPL: 0CVE-2005-1769
https://notcve.org/view.php?id=CVE-2005-1769
16 Jun 2005 — Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in (1) the URL or (2) an e-mail message. • http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html •
CVSS: 6.1EPSS: 1%CPEs: 22EXPL: 0CVE-2005-0104
https://notcve.org/view.php?id=CVE-2005-0104
29 Jan 2005 — Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables. • http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html •