CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2005-0075
https://notcve.org/view.php?id=CVE-2005-0075
prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers. • http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html http://marc.info/?l=bugtraq&m=110702772714662&w=2 http://secunia.com/advisories/13962 http://www.gentoo.org/security/en/glsa/glsa-200501-39.xml http://www.redhat.com/support/errata/RHSA-2005-099.html http://www.redhat.com/support/errata/RHSA-2005-135.html http://www.squirrelmail.org/security/issue/2005-01-14 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9587 http •
CVSS: 7.5EPSS: 2%CPEs: 21EXPL: 0CVE-2005-0103
https://notcve.org/view.php?id=CVE-2005-0103
PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code. • http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html http://marc.info/?l=bugtraq&m=110702772714662&w=2 http://secunia.com/advisories/13962 http://www.gentoo.org/security/en/glsa/glsa-200501-39.xml http://www.redhat.com/support/errata/RHSA-2005-099.html http://www.redhat.com/support/errata/RHSA-2005-135.html http://www.squirrelmail.org/security/issue/2005-01-19?PHPSESSID=8af117822fb1ca3aa966a64248b5d223 https://exchange.xforce.ibmcloud.com/vulnerabilities/19037 https:&# • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 2%CPEs: 22EXPL: 0CVE-2004-1036
https://notcve.org/view.php?id=CVE-2004-1036
Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000905 http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.html http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html http://marc.info/?l=bugtraq&m=110012133608004&w=2 http://voxel.dl.sourceforge.net/sourceforge/squirrelmail/sm143a-xss.diff http://www.gentoo.org/security/en/glsa/glsa-200411-25.xml http://www.squirrelmail.org https://exchange.xforce.ibmcloud.com/vulnerabilities/18031 https:/&#x •
CVSS: 6.8EPSS: 3%CPEs: 21EXPL: 2CVE-2004-0639 – SquirrelMail 1.2.x - From Email Header HTML Injection
https://notcve.org/view.php?id=CVE-2004-0639
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados en Squirrelmail 1.2.10 y anteriores permiten a atacantes remotos inyectar HTML o script de su elección mediante (1) la variable $mailer en read_body.php, (2) la variable $senderNames_part en mailbox_display.php, y posiblemente otros vectores,incluyendo (3) la variable $event_text. • https://www.exploit-db.com/exploits/24167 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 http://marc.info/?l=bugtraq&m=108611554415078&w=2 http://www.debian.org/security/2004/dsa-535 http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt http://www.securityfocus.com/bid/10450 https://exchange.xforce.ibmcloud.com/vulnerabilities/16285 •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2004-0521
https://notcve.org/view.php?id=CVE-2004-0521
SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php. Vulnerabilidad de inyección de SQL en SquirrelMail anteriores a 1.4.3 RC1 permite a atacantes remotos ejecutar sentencias SQL no autorizadas, con impacto desconocido, probablemente mediante abook_database.php. • ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 http://marc.info/?l=squirrelmail-cvs&m=108309375029888 http://marc.info/?l=squirrelmail-cvs&m=108532891231712 http://rhn.redhat.com/errata/RHSA-2004-240.html http://secunia.com/advisories/11685 http://secunia.com/advisories/11686 http://secunia.com/advisories/11870 http://secunia.com/advisories/12289 http://security.gentoo.org/glsa/glsa •