CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-2631
https://notcve.org/view.php?id=CVE-2007-2631
Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors. NOTE: this issue might overlap CVE-2007-2589 or CVE-2002-1648. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en SquirrelMail 1.4.8-4.fc6 y anteriores permite a atacantes remotos realizar acciones no especificada en usuarios de su elección a través de vectores no especificados. NOTA: Este asunto podría solaparse con CVE-2007-2589 o CVE-2002-1648. • http://osvdb.org/35890 http://www.securityfocus.com/archive/1/468220/100/0/threaded http://www.securityfocus.com/archive/1/468253/100/0/threaded •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2007-1262 – XSS through HTML message in squirrelmail
https://notcve.org/view.php?id=CVE-2007-1262
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el filtro de HTML en el SquirrelMail 1.4.0 hasta la 1.4.9a permiten a atacantes remotos la inyección de secuencias de comandos web o HTML de su elección mediante (1) datos: un URI en un adjunto de un correo electrónico en HTML o (2) mediante varios juegos de caracteres no-ASCII que no son filtrados adecuadamente cuando son visualizados por el Microsoft Internet Explorer. • http://docs.info.apple.com/article.html?artnum=306172 http://jvn.jp/en/jp/JVN09157962/index.html http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000398.html http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://osvdb.org/35887 http://osvdb.org/35888 http://secunia.com/advisories/25200 http://secunia.com/advisories/25236 http://secunia.com/advisories/25320 http://secunia.com/advisories/25690 http://secunia.com/advisories/25787 http:/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 18EXPL: 0CVE-2007-2589 – CSRF through HTML message in squirrelmail
https://notcve.org/view.php?id=CVE-2007-2589
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el compose.php del SquirrelMail 1.4.0 hasta la 1.4.9a permite a atacantes remotos enviar correos electrónicos desde usuarios de su elección, a través de determinados datos en el atributo SRC de un elemento IMG. • http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://osvdb.org/35889 http://secunia.com/advisories/25200 http://secunia.com/advisories/25320 http://secunia.com/advisories/25787 http://secunia.com/advisories/26235 http://www.mandriva.com/security/advisories?name=MDKSA-2007:106 http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.securityfocus.com/bid/25159 http://www&# • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 2%CPEs: 15EXPL: 0CVE-2006-6142 – Three XSS issues in SquirrelMail
https://notcve.org/view.php?id=CVE-2006-6142
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el (1) parámetro mailto en (a) webmail.php, los parámetros (2) session y (3) delete_draft en (b) compose.php, y (4) vectores no especificados implicando "a shortcoming in the magicHTML filter." • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://fedoranews.org/cms/node/2438 http://fedoranews.org/cms/node/2439 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/23195 http://secunia.com/advisories/23322 http://secunia.com/advisories/23409 http://secunia.com/advisories/23504 http://secunia.com/advisories/23811 http://secunia.com&#x •
CVSS: 6.4EPSS: 27%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://attrition.org/pipermail/vim/2006-August/000970.html http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http:/&# •