CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0CVE-2007-6348
https://notcve.org/view.php?id=CVE-2007-6348
14 Dec 2007 — SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability, which allows remote attackers to execute arbitrary code. SquirrelMail versiones 1.4.11 y 1.4.12, distribuidas en sourceforge.net versiones anteriores a 20071213, se han modificado externamente para crear un Caballo de Troya que introduce una vulnerabilidad de inclusión remota de archivos PHP, que permite a los atac... • http://marc.info/?l=bugtraq&m=119765643909825&w=2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3634
https://notcve.org/view.php?id=CVE-2007-3634
10 Jul 2007 — Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpg_sign_attachment function, aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other C... • http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3635
https://notcve.org/view.php?id=CVE-2007-3635
10 Jul 2007 — Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634. Múltiples vulnerabilidades no especificadas en el plugin G/PGP (GPG) versiones anteriores a 2.1 para Squirrelmail, podrían permitir a "local authenticated users" inyectar ciertos comandos por medio de vectores no especificados. NOTA: esto podría solaparse ... • http://osvdb.org/45789 •
CVSS: 9.8EPSS: 5%CPEs: 2EXPL: 1CVE-2007-3636 – SquirrelMail G/PGP Encryption Plugin 2.0/2.1 - Multiple Remote Command Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-3636
10 Jul 2007 — Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectors. NOTE: this information is based upon a vague pre-advisory from a reliable researcher. Múltiples vulnerabilidades no especificadas en G/PGP (GPG) Plugin 2.1 para Squirrelmail permite a atacantes remotos ejecutar comandos de su elección a través de vectores no especificados. NOTA: esta información está basada en un pre-aviso poco preciso de un invest... • https://www.exploit-db.com/exploits/30283 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-2631
https://notcve.org/view.php?id=CVE-2007-2631
13 May 2007 — Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors. NOTE: this issue might overlap CVE-2007-2589 or CVE-2002-1648. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en SquirrelMail 1.4.8-4.fc6 y anteriores permite a atacantes remotos realizar acciones no especificada en usuarios de su elección a través de vectores no especificados. NOTA: Este asunto podrí... • http://osvdb.org/35890 •
CVSS: 6.1EPSS: 1%CPEs: 18EXPL: 0CVE-2007-1262 – XSS through HTML message in squirrelmail
https://notcve.org/view.php?id=CVE-2007-1262
11 May 2007 — Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el filtro de HTML en el SquirrelMail 1.4.0 hasta la 1.4.9a permiten a atacantes remotos la in... • http://docs.info.apple.com/article.html?artnum=306172 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2007-2589 – CSRF through HTML message in squirrelmail
https://notcve.org/view.php?id=CVE-2007-2589
11 May 2007 — Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el compose.php del SquirrelMail 1.4.0 hasta la 1.4.9a permite a atacantes remotos enviar correos electrónicos desde usuarios de su elección, a través de determinados datos en el atributo SRC de un elemento IMG. • http://docs.info.apple.com/article.html?artnum=306172 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 3%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
05 Dec 2006 — Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de com... • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc •
CVSS: 9.1EPSS: 26%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
11 Aug 2006 — Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3665
https://notcve.org/view.php?id=CVE-2006-3665
17 Jul 2006 — SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this. SquirrelMail 1.4.6 y anteriores, con register_globals habilitado, permite a atacantes remotos secuestrar cookies en src/redirect.php a través de vectores desconocidos. NOTA: mientras que el "robo de la cookie" se asocia con el XSS, el vendedor in... • http://www.securityfocus.com/bid/17005 •