CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3663 – squirrelmail: session hijacking - secure flag not set for HTTPS-only cookies
https://notcve.org/view.php?id=CVE-2008-3663
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. Squirrelmail 1.4.15 no establece la bandera de seguridad para la cookie de sesión en una sesión https, lo que podría provocar que la cookie pudiera ser enviada en peticiones http y facilitar a atacantes remotos capturar esta cookie. • http://int21.de/cve/CVE-2008-3663-squirrelmail.html http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://secunia.com/advisories/33937 http://securityreason.com/securityalert/4304 http://support.apple.com/kb/HT3438 http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html http://www.securityfocus.c • CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 2%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el (1) parámetro mailto en (a) webmail.php, los parámetros (2) session y (3) delete_draft en (b) compose.php, y (4) vectores no especificados implicando "a shortcoming in the magicHTML filter." • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://fedoranews.org/cms/node/2438 http://fedoranews.org/cms/node/2439 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/23195 http://secunia.com/advisories/23322 http://secunia.com/advisories/23409 http://secunia.com/advisories/23504 http://secunia.com/advisories/23811 http://secunia.com&#x •
CVSS: 6.4EPSS: 27%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://attrition.org/pipermail/vim/2006-August/000970.html http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http:/&# •
CVSS: 2.6EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3174
https://notcve.org/view.php?id=CVE-2006-3174
Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter. • http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://pridels0.blogspot.com/2006/06/squirrelmail-151-xss-vuln.html http://secunia.com/advisories/26235 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://www.osvdb.org/26610 http://www.securityfocus.com/bid/18700 http://www.securityfocus.com/bid/25159 http://www.vupen.com/english/advisories/2007/2732 https://exchange.xforce.ib •
CVSS: 4.3EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0188
https://notcve.org/view.php?id=CVE-2006-0188
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://secunia.com/advisories/18985 http://secunia.com/advisories/19130 http://secunia.com/advisories/19131 http://secunia.com/advisories/19176 http://secunia.com/advisories/19205 http://secunia.com/advisories/19960 http://secunia.com/advisories/20210 http://securitytracker.com/id?1015662 http://www.debian.org/security/2006/dsa-988 http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml http:/ •