Download
| Alert*
|
CVE-2018-14955
The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute). CVE-2018-14954 The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute. CVE-2018-14951 The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack. CVE-2018-14950 The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack. CVE-2018-14953 The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack. CVE-2018-14952 The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack. CVE-2018-8741 A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php. |
