CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBE |
| 01/07/2019 |
| CVE-2018-14955 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute). | 05/08/2018 |
| CVE-2018-14954 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute. | 05/08/2018 |
| CVE-2018-14953 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack. | 05/08/2018 |
| CVE-2018-14952 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack. | 05/08/2018 |
| CVE-2018-14951 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack. | 05/08/2018 |
| CVE-2018-14950 | 中危6.1 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack. | 05/08/2018 |
| CVE-2018-8741 | 高危8.8 | A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php. | 17/03/2018 |
| CVE-2017-7692 | 高危8.8 | SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class | 20/04/2017 |
| CVE-2011-2753 | 中危6.8 | Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555. | 17/07/2011 |
| CVE-2011-2752 | 中危5.8 | CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555. | 17/07/2011 |
| CVE-2011-2023 | 中危4.3 | Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message. | 14/07/2011 |
| CVE-2010-4555 | 中危4.3 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index | 14/07/2011 |
| CVE-2010-4554 | 中危4.3 | functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. | 14/07/2011 |
| CVE-2010-2813 | 中危5.0 | functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files. | 19/08/2010 |
| CVE-2010-1637 | 中危6.5 | The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number. | 22/06/2010 |
| CVE-2009-2964 | 中危6.8 | Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_searc | 25/08/2009 |