SQ
Product
Squirrelmail
64
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 8Low 0
Watch
Add Squirrelmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-0521 | – | Aug 18 | SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php Affected: 1.0.4; 1.0.5; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +11 more |
| CVE-2004-0519 | – | Aug 18 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication… Affected: 1.0.4; 1.0.5; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +11 more |
| CVE-2004-0639 | – | Aug 6 | Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +11 more |
| CVE-2003-0160 | – | Apr 2 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web… Affected: through 1.2.11 |
| CVE-2002-1649 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag Affected: 1.2.2 |
| CVE-2002-2086 | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) "<<script" in… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 |
| CVE-2002-1650 | – | Dec 31 | The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter Affected: 1.2.2 |
| CVE-2002-1648 | – | Dec 31 | Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified… Affected: 1.2.2 |
| CVE-2002-1341 | – | Dec 18 | Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2)… Affected: 1.2.6; 1.2.7; 1.2.8; 1.2.9; 1.2.10 |
| CVE-2002-1276 | – | Nov 29 | An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to… Affected: 1.2.8 |
| CVE-2002-1132 | – | Oct 4 | SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error… Affected: through 1.2.7 |
| CVE-2002-1131 | – | Oct 4 | Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3)… Affected: through 1.2.7 |
| CVE-2002-0516 | – | Aug 12 | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 |
| CVE-2001-1159 | – | Jul 2 | load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive… Affected: 1.0.4; 1.0.5 |