FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-19 20:48:44 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
21b7c550-2a22-11db-a6e2-000e0c2e438asquirrelmail -- random variable overwrite vulnerability

The SquirrelMail developers report:

A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments.


Discovery 2006-08-11
Entry 2006-08-12
ja-squirrelmail
ge 1.4.0 lt 1.4.8,2

squirrelmail
ge 1.4.0 lt 1.4.8

CVE-2006-4019
http://www.squirrelmail.org/security/issue/2006-08-11
79630c0c-8dcc-45d0-9908-4087fe1d618csquirrelmail -- XSS and remote code injection vulnerabilities

A SquirrelMail Security Advisory reports:

SquirrelMail 1.4.4 has been released to resolve a number of security issues disclosed below. It is strongly recommended that all running SquirrelMail prior to 1.4.4 upgrade to the latest release.

Remote File Inclusion

Manoel Zaninetti reported an issue in src/webmail.php which would allow a crafted URL to include a remote web page. This was assigned CAN-2005-0103 by the Common Vulnerabilities and Exposures.

Cross Site Scripting Issues

A possible cross site scripting issue exists in src/webmail.php that is only accessible when the PHP installation is running with register_globals set to On. This issue was uncovered internally by the SquirrelMail Development team. This isssue was assigned CAN-2005-0104 by the Common Vulnerabilities and Exposures.

A second issue which was resolved in the 1.4.4-rc1 release was uncovered and assigned CAN-2004-1036 by the Common Vulnerabilities and Exposures. This issue could allow a remote user to send a specially crafted header and cause execution of script (such as javascript) in the client browser.

Local File Inclusion

A possible local file inclusion issue was uncovered by one of our developers involving custom preference handlers. This issue is only active if the PHP installation is running with register_globals set to On.


Discovery 2005-01-29
Entry 2005-06-01
squirrelmail
ja-squirrelmail
< 1.4.4

CVE-2004-1036
CVE-2005-0075
CVE-2005-0103
CVE-2005-0104
http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662
http://www.squirrelmail.org/security/issue/2005-01-14
http://www.squirrelmail.org/security/issue/2005-01-19
http://www.squirrelmail.org/security/issue/2005-01-20
7d52081f-2795-11da-bc01-000e0c2e438asquirrelmail -- _$POST variable handling allows for various attacks

A Squirrelmail Advisory reports:

An extract($_POST) was done in options_identities.php which allowed for an attacker to set random variables in that file. This could lead to the reading (and possible writing) of other people's preferences, cross site scripting or writing files in webserver-writable locations.


Discovery 2005-07-13
Entry 2005-09-17
Modified 2005-09-19
squirrelmail
ja-squirrelmail
ge 1.4.0 lt 1.4.5

14254
CVE-2005-2095
http://www.squirrelmail.org/security/issue/2005-07-13
7fbfe159-3438-11d9-a9e7-0001020eed82squirrelmail -- cross site scripting vulnerability

A SquirrelMail Security Notice reports:

There is a cross site scripting issue in the decoding of encoded text in certain headers. SquirrelMail correctly decodes the specially crafted header, but doesn't sanitize the decoded strings.


Discovery 2004-11-03
Entry 2004-11-12
ja-squirrelmail
< 1.4.3a_4,2

squirrelmail
< 1.4.3a_3

http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004
e879ca68-e01b-11d9-a8bd-000cf18bbe54squirrelmail -- Several cross site scripting vulnerabilities

A SquirrelMail Security Advisory reports:

Several cross site scripting (XSS) vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4.

The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email to a victim. When done very carefully, this can cause the session of the user to be hijacked.


Discovery 2005-06-15
Entry 2005-06-18
squirrelmail
ja-squirrelmail
ge 1.4.0 le 1.4.4

CVE-2005-1769
http://www.squirrelmail.org/security/issue/2005-06-15