Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 68

Export CSV
CVE-2019-12970

squirrelmail: improper handling of RCDATA and RAWTEXT type elements causing XSS

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-8741

SquirrelMail: Directory traversal flaw in Deliver.class.php can allow a remote attacker to retrieve or delete arbitrary files

A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php.

CVSS 3.0 · 8.8 High EPSS 4.2% KEV · Not listed
Vendors
Debian Squirrelmail
Products
Debian Linux Squirrelmail
CVE-2018-14955

squirrelmail: persistent XSS in message display via SVG animations

The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-14954

squirrelmail: persistent XSS in message display the formaction attribute

The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.

CVSS 3.0 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-14953

squirrelmail: persistent XSS in message display via a "<math xlink:href="

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-14952

squirrelmail: persistent XSS in message display via a "<math><maction xlink:href="

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-14951

squirrelmail: persistent XSS in message display via a "<form action='data:text"

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail
CVE-2018-14950

squirrelmail: persistent XSS in message display via a "<svg><a xlink:href="

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Squirrelmail
Products
Squirrelmail