REDHAT-BUG-500363: XSS

First published: Tue May 12 2009(Updated: )

A, From SquirrelMail vulnerability report (<a href="http://www.squirrelmail.org/security/issue/2009-05-08">http://www.squirrelmail.org/security/issue/2009-05-08</a>): Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links. Credits: Niels Teusink and Christian Balzer Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&amp;revision=13670">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&amp;revision=13670</a> B, From SquirrelMail vulnerability report: (<a href="http://www.squirrelmail.org/security/issue/2009-05-09">http://www.squirrelmail.org/security/issue/2009-05-09</a>): An issue was fixed wherein input to the contrib/decrypt_headers.php script was not sanitized and allowed arbitrary script execution upon submission of certain values. Credits: Niels Teusink Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&amp;revision=13672">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&amp;revision=13672</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2009-1578
• agent/type
• agent/references
• agent/last-modified-date
• agent/first-publish-date
• agent/severity
• agent/weakness
• agent/description
• agent/event
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/squirrelmail
• canonical/squirrelmail