Show filters
35 Total Results
Displaying 21-30 of 35
Sort by:
Attacker Value
Unknown
CVE-2012-1918
Disclosure Date: March 27, 2012 (last updated October 04, 2023)
Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. (dot dot) in the Attachment[] parameter.
0
Attacker Value
Unknown
CVE-2012-1917
Disclosure Date: March 27, 2012 (last updated October 04, 2023)
compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
0
Attacker Value
Unknown
CVE-2011-4540
Disclosure Date: December 01, 2011 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to (1) ldap.php or (2) search.php.
0
Attacker Value
Unknown
CVE-2008-3579
Disclosure Date: August 10, 2008 (last updated October 04, 2023)
Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive information by creating and downloading a backup archive of the entire @Mail directory tree. NOTE: this can be leveraged for remote exploitation of CVE-2008-3395. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2008-3395
Disclosure Date: July 31, 2008 (last updated October 04, 2023)
Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2007-6196
Disclosure Date: December 01, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in util.php in Calacode @Mail before 5.2 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
0
Attacker Value
Unknown
CVE-2007-2825
Disclosure Date: May 22, 2007 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) links and (2) images.
0
Attacker Value
Unknown
CVE-2007-2153
Disclosure Date: April 19, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
0
Attacker Value
Unknown
CVE-2007-0953
Disclosure Date: February 15, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in search.pl in @Mail 4.61 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
0
Attacker Value
Unknown
CVE-2006-6702
Disclosure Date: December 23, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail messages. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
0
