CVSS: 7.5EPSS: 3%CPEs: 2EXPL: 1CVE-2007-3636 – SquirrelMail G/PGP Encryption Plugin 2.0/2.1 - Multiple Remote Command Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-3636
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectors. NOTE: this information is based upon a vague pre-advisory from a reliable researcher. Múltiples vulnerabilidades no especificadas en G/PGP (GPG) Plugin 2.1 para Squirrelmail permite a atacantes remotos ejecutar comandos de su elección a través de vectores no especificados. NOTA: esta información está basada en un pre-aviso poco preciso de un investigador creible. • https://www.exploit-db.com/exploits/30283 http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html http://osvdb.org/45790 http://www.attrition.org/pipermail/vim/2007-July/001703.html http://www.securityfocus.com/bid/24828 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3635
https://notcve.org/view.php?id=CVE-2007-3635
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634. Múltiples vulnerabilidades no especificadas en el plugin G/PGP (GPG) versiones anteriores a 2.1 para Squirrelmail, podrían permitir a "local authenticated users" inyectar ciertos comandos por medio de vectores no especificados. NOTA: esto podría solaparse con CVE-2005-1924, CVE-2006-4169 o CVE-2007-3634. • http://osvdb.org/45789 http://www.attrition.org/pipermail/vim/2007-July/001703.html http://www.squirrelmail.org/plugin_view.php?id=153 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3634
https://notcve.org/view.php?id=CVE-2007-3634
Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpg_sign_attachment function, aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine. Una vulnerabilidad no especificada en el plugin G/PGP (GPG) versión 2.0 para Squirrelmail versión 1.4.10a, permite a usuarios autenticados remotoss ejecutar comandos arbitrarios por medio de vectores no especificados, posiblemente relacionados con la variable passphrase en la función gpg_sign_attachment, también se conoce como ZD-0000000004. Esta información está basada en un aviso vago de una organización de ventas de información sobre vulnerabilidades que no coordina con los proveedores o publica avisos procesables. • http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html http://osvdb.org/45788 http://www.attrition.org/pipermail/vim/2007-July/001703.html http://www.securityfocus.com/bid/24782 http://www.wslabi.com/wabisabilabi/initPublishedBid.do? •
CVSS: 6.8EPSS: 2%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el (1) parámetro mailto en (a) webmail.php, los parámetros (2) session y (3) delete_draft en (b) compose.php, y (4) vectores no especificados implicando "a shortcoming in the magicHTML filter." • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://fedoranews.org/cms/node/2438 http://fedoranews.org/cms/node/2439 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/23195 http://secunia.com/advisories/23322 http://secunia.com/advisories/23409 http://secunia.com/advisories/23504 http://secunia.com/advisories/23811 http://secunia.com&#x •
CVSS: 6.4EPSS: 27%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://attrition.org/pipermail/vim/2006-August/000970.html http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http:/&# •