Filtered by vendor Squirrelmail Subscriptions
Filtered by product Squirrelmail Subscriptions
Total 67 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2002-1648 1 Squirrelmail 1 Squirrelmail 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters.
CVE-2002-1341 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passed_id parameters.
CVE-2002-1276 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2024-11-21 N/A
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
CVE-2002-1132 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2024-11-21 N/A
SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script.
CVE-2002-1131 2 Redhat, Squirrelmail 2 Linux, Squirrelmail 2024-11-21 N/A
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
CVE-2002-0516 1 Squirrelmail 1 Squirrelmail 2024-11-21 N/A
SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
CVE-2001-1159 1 Squirrelmail 1 Squirrelmail 2024-11-21 N/A
load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.