CVSS: 6.4EPSS: 27%CPEs: 15EXPL: 1CVE-2006-4019 – SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite
https://notcve.org/view.php?id=CVE-2006-4019
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. Vulnerabilidad de evaluación de variable dinámica en compose.php en SquirrelMail 1.4.0 hasta la versión 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios. • https://www.exploit-db.com/exploits/43839 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://attrition.org/pipermail/vim/2006-August/000970.html http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http:/&# •
CVSS: 2.6EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3174
https://notcve.org/view.php?id=CVE-2006-3174
Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter. • http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://pridels0.blogspot.com/2006/06/squirrelmail-151-xss-vuln.html http://secunia.com/advisories/26235 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://www.osvdb.org/26610 http://www.securityfocus.com/bid/18700 http://www.securityfocus.com/bid/25159 http://www.vupen.com/english/advisories/2007/2732 https://exchange.xforce.ib •
CVSS: 4.3EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0188
https://notcve.org/view.php?id=CVE-2006-0188
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://secunia.com/advisories/18985 http://secunia.com/advisories/19130 http://secunia.com/advisories/19131 http://secunia.com/advisories/19176 http://secunia.com/advisories/19205 http://secunia.com/advisories/19960 http://secunia.com/advisories/20210 http://securitytracker.com/id?1015662 http://www.debian.org/security/2006/dsa-988 http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml http:/ •
CVSS: 4.3EPSS: 1%CPEs: 12EXPL: 0CVE-2006-0195
https://notcve.org/view.php?id=CVE-2006-0195
Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://secunia.com/advisories/18985 http://secunia.com/advisories/19130 http://secunia.com/advisories/19131 http://secunia.com/advisories/19176 http://secunia.com/advisories/19205 http://secunia.com/advisories/19960 http://secunia.com/advisories/20210 http://securitytracker.com/id?1015662 http://www.debian.org/security/2006/dsa-988 http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml http:/ •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2006-0377
https://notcve.org/view.php?id=CVE-2006-0377
CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection." SquirrelMail versions 1.4.5 and below suffer from an IMAP injection flaw. Versions 1.2.7 and below suffer from a SMTP injection flaw. Details provided. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://secunia.com/advisories/18985 http://secunia.com/advisories/19130 http://secunia.com/advisories/19131 http://secunia.com/advisories/19176 http://secunia.com/advisories/19205 http://secunia.com/advisories/19960 http://secunia.com/advisories/20210 http://securitytracker.com/id?1015662 http://www.debian.org/security/2006/dsa-988 http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml http:/ •