NVD

Id
59548  
Name
CVE-2006-0818  
Description
Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:N)  
Pub Date
2016-12-20  
Published
2006-07-21  
Modified Date
2016-08-30  
Seq
2006-0818  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
306284 59548 CVE-2006-0818 1016513  View
306285 59548 CVE-2006-0818 1016514  View
306286 59548 CVE-2006-0818 20060717 Secunia Research: IceWarp Web Mail Two File InclusionVulnerabilities  View
306287 59548 CVE-2006-0818 20060717 Secunia Research: VisNetic Mail Server Two File InclusionVulnerabilities  View
306288 59548 CVE-2006-0818 19002  View
306289 59548 CVE-2006-0818 19007  View
306290 59548 CVE-2006-0818 ADV-2006-2825  View
306291 59548 CVE-2006-0818 visnetic-language-file-include(27780)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60452 JVNDB-2006-002718 MERAK Mail Server および VisNetic MailServer における絶対パスディレクトリトラバーサルの脆弱性 (1) IceWarp Web Mail 以前の Windows 用の MERAK Mail Server および (2) VisNetic MailServer は、validatefolder PHP 関数が適切にサニタイズしないため、絶対パスディレクトリトラバーサルの脆弱性が存在します。 CVE-2006-0818 16920 CVE-2006-0818 59548 4 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002718.html 2006-07-21 2012-12-20 View