Filtered by vendor Squirrelmail Subscriptions

Search

Switch to Advanced Search (Beta)
Total 77 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2005-0184 1 Squirrelmail 1 Vacation Plugin 2025-04-03 N/A
Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary files via a .. (dot dot) in a get request.
CVE-2005-3128 1 Squirrelmail 1 Address Add Plugin 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG tag.
CVE-2003-0160 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2025-04-03 N/A
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser.
CVE-2001-1159 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.
CVE-2002-0516 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
CVE-2002-1131 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2025-04-03 N/A
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
CVE-2002-1341 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passed_id parameters.
CVE-2002-1650 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
CVE-2006-3665 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.
CVE-2004-0519 3 Redhat, Sgi, Squirrelmail 3 Enterprise Linux, Propack, Squirrelmail 2025-04-03 N/A
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
CVE-2005-0239 1 Squirrelmail 1 S Mime Plugin 2025-04-03 N/A
viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter.
CVE-2005-1924 1 Squirrelmail 1 Gpg Plugin 2025-04-03 N/A
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.
CVE-2005-0152 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."
CVE-2006-3174 1 Squirrelmail 1 Squirrelmail 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter.
CVE-2006-4019 2 Redhat, Squirrelmail 2 Enterprise Linux, Squirrelmail 2025-04-03 N/A
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
CVE-2003-0990 1 Squirrelmail 2 Gpg Plugin, Squirrelmail 2025-04-03 N/A
The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field.
CVE-2004-0521 3 Redhat, Sgi, Squirrelmail 3 Enterprise Linux, Propack, Squirrelmail 2025-04-03 N/A
SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php.
CVE-2004-1036 3 Gentoo, Redhat, Squirrelmail 3 Linux, Enterprise Linux, Squirrelmail 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML.
CVE-2005-0104 2 Redhat, Squirrelmail 2 Enterprise Linux, Squirrelmail 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables.
CVE-2002-1276 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2025-04-03 N/A
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.