[Tickets #14926] Re: Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails <= v5.2.22
[email protected] Mon, 18 Nov 2019 21:25:44 +0100
| Newsgroups | gmane.comp.horde.bugs |
|---|---|
| Message-ID | <[email protected]> |
QklUVEUgTklDSFQgQVVGIERJRVNFIE5BQ0hSSUNIVCBBTlRXT1JURU4uIE5BQ0hSSUNIVEVOIEFO IERJRVNFICAKRS1NQUlMLUFEUkVTU0UgV0VSREVOIE5JQ0hUIEdFTEVTRU4uCgpUaWNrZXQtVVJM OiBodHRwczovL2J1Z3MuaG9yZGUub3JnL3RpY2tldC8xNDkyNgotLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0KICBUaWNrZXQgICAgICAgICAgIHwgMTQ5MjYKICBBa3R1YWxpc2llcnQgVm9uIHwgSmFuIFNj aG5laWRlciA8amFuQGhvcmRlLm9yZz4KICBadXNhbW1lbmZhc3N1bmcgIHwgSG9yZGUgV2VibWFp bCAtIFhTUyArIENTUkYgdG8gU1FMaSwgUkNFLCBTdGVhbGluZyBFbWFpbHMKICAgICAgICAgICAg ICAgICAgIHwgPD0gdjUuMi4yMgogIFdhcnRlc2NobGFuZ2UgICAgfCBIb3JkZSBHcm91cHdhcmUK ICBWZXJzaW9uICAgICAgICAgIHwgNS4yLjIyCiAgVHlwICAgICAgICAgICAgICB8IEJ1ZwotU3Rh dHVzICAgICAgICAgICB8IFVuY29uZmlybWVkCitTdGF0dXMgICAgICAgICAgIHwgUmVzb2x2ZWQK ICBQcmlvcml0w6R0ICAgICAgICB8IDMuIEhpZ2gKICBNaWxlc3RvbmUgICAgICAgIHwKICBQYXRj aCAgICAgICAgICAgIHwKICBadXN0w6RuZGlnZSAgICAgICB8Ci0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKCkphbiBTY2huZWlkZXIgPGphbkBob3JkZS5vcmc+ICgyMDE5LTExLTE4IDIxOjI1KSBoYXQg Z2VzY2hyaWViZW46CgpGb3IgdGhlIHJlY29yZDoKKiBUaGUgWFNTIGluIHRoZSBIb3JkZSB0YWcg Y2xvdWQgd2lkZ2V0IGhhZCBhbHJlYWR5IGJlZW4gZGlzY292ZXJlZCwgIApmaXhlZCwgYW5kIHJl bGVhc2VkIGJ5IG91cnNlbHZlcyB3aXRoIEhvcmRlIDUuMi4yMSBvbiBBcHJpbCAyMSwgYmVmb3Jl ICAKdGhlIHJlcG9ydDogaHR0cHM6Ly9saXN0cy5ob3JkZS5vcmcvYXJjaGl2ZXMvYW5ub3VuY2Uv MjAxOS8wMDEyNzguaHRtbCAgCldpdGhvdXQgdGhpcywgdGhlIHdob2xlICJhdHRhY2siIGlzIG5v dCBleHBsb2l0YWJsZS4KKiBBZGRpbmcgYm9va21hcmtzIGluIFRyZWFuIGlzIGluZGVlZCBub3Qg Q1NSRiBwcm90ZWN0ZWQsIGJ1dCB0aGF0J3MgIApsb3cgcHJpb3JpdHkgZm9yIHVzLCBiZWNhdXNl IGl0J3MgYSBub24tZGVzdHJ1Y3RpdmUgYWN0aW9uLgoqIEdFVHRpbmcgSU1BUCBtZXNzYWdlcyBm cm9tIElNUCBpcyBhIGNvcmUgZnVuY3Rpb25hbGl0eSBvZiB0aGUgIAp3ZWJtYWlsIGNsaWVudCBh bmQgaXMgaGFyZGx5IHRvIGJlIGNhbGxlZCBhIHZ1bG5lcmFiaWxpdHkuIFdoZXRoZXIgaXQgIAp3 b3VsZCBtYWtlIHNlbnNlIHRvIHRva2VuLXByb3RlY3RlZCBzdWNoIHJlcXVlc3RzIGlzIGF0IGxl YXN0IGRlYmF0YWJsZS4KKiBUaGUgcmVwb3J0ZXIgaXJyZXNwb25zaWJseSBkaXNjbG9zZWQgaGlz IGZpbmRpbmdzLCBiZWNhdXNlIHdlIHdlcmUgIApub3Qgd2lsbGluZywgbm9yIGFibGUgdG8gcGF5 IGhpbSBhIGJvdW50eSBwcmljZSB1cGZyb250LgoKQWxzbyBmb3IgdGhlIHJlY29yZHMsIHRoZXNl IGZpbmRpbmcgaGF2ZSBiZWVuIGFzc2lnbmVkIENWRSAyMDE5LTEyMDk0ICAKJiBDVkUtMjAxOS0x MjA5NS4KCkNvbmNsdXNpb246IG5vIEhvcmRlIGluc3RhbGxhdGlvbiBpbnN0YWxsZWQgb3IgdXBk YXRlZCBzaW5jZSBBcHJpbCAgCjIxc3QgMjAxOSBpcyB2dWxuZXJhYmxlIHRvIHRoaXMgZXhwbG9p dC4KCgoKCi0tIApidWdzIG1haWxpbmcgbGlzdApGcmVxdWVudGx5IEFza2VkIFF1ZXN0aW9uczog aHR0cDovL3dpa2kuaG9yZGUub3JnL0ZBUQpUbyB1bnN1YnNjcmliZSwgbWFpbDogYnVncy11bnN1 YnNjcmliZUBsaXN0cy5ob3JkZS5vcmcK