Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam™ in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	VPOP3 Web Mail Cross-Site Scripting Vulnerability 20 Oct. 2003    Summary VPOP3 is "an Internet email server and gateway for small and medium sized businesses". A security vulnerability in the product allows remote attackers to steal the authentication cookie stored by the server, by inserting malicious HTML and/or JavaScript into the login page.   Credit: The information has been provided by SecurITeam Experts.    Details Audit your web server for security holes - see what the hackers see. Sign up for a scan today - risk free! Vulnerable systems:  * VPOP3 version 2.0.0e  * VPOP3 version 2.0.0f Immune systems:  * VPOP3 version 2.0.0g By requesting a specially crafted URL, it is possible to cause the VPOP3's Web Mail server to return arbitrary HTML and/or JavaScript, by using a URL such as: http://192.168.1.212:5108/index.html?redirect=admin/index.html";%0Dalert(document.cookie);%0D// It is possible to steal the cookie (used for authentication) from a user (preferably the administrator) and to impersonate him.  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles AVTECH PageR Enterprise Directory Traversal Google Chrome Browser Automatic File Download Novell iPrint Client nipplib.dll "IppCreateServerRef()" Buffer Overflow Microsoft ASP.NET ValidateRequest Filters Bypassing Allows XSS And HTML Injection Attacks Kyocera Mita Scanner File Utility (Multiple) Novell iPrint Client ActiveX Control Multiple Vulnerabilities DriveCrypt Security Model Bypass and Incorrect BIOS API Usage Windows Media Services (nskey.dll) CallHTMLHelp Buffer Overflow Trend Micro Products Web Management Authentication Bypass Anzio Web Print Object Buffer Overflow Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass (MS08-043) Microsoft Windows Messenger Illegal Access Vulnerability (MS08-050) MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface Symantec Veritas Storage Foundation Scheduler Service NULL Session Authentication Bypass Vulnerability Vulnerability in Cisco WebEx Meeting Manager ActiveX Control  Featured Articles Google Chrome Browser Automatic File Download Microsoft ASP.NET ValidateRequest Filters Bypassing Allows XSS And HTML Injection Attacks vBulletin Cross Site Scripting Vulnerability (popup) Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass (MS08-043) MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface Sun xVM VirtualBox Privilege Escalation Vulnerability Vulnerabilities in DNS Allows Spoofing (MS08-037)
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®