CVE-2004-0520

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858
http://marc.info/?l=bugtraq&m=108611554415078&w=2
http://marc.info/?l=squirrelmail-cvs&m=108532891231712
http://rhn.redhat.com/errata/RHSA-2004-240.htmlPatch, Vendor Advisory
http://secunia.com/advisories/11870Patch, Vendor Advisory
http://secunia.com/advisories/12289Patch, Vendor Advisory
http://www.debian.org/security/2004/dsa-535Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200406-08.xmlVendor Advisory
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txtVendor Advisory
http://www.securityfocus.com/advisories/6827Patch, Vendor Advisory
http://www.securityfocus.com/bid/10439Exploit, Patch
https://bugzilla.fedora.us/show_bug.cgi?id=1733Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1012
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10766
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858
http://marc.info/?l=bugtraq&m=108611554415078&w=2
http://marc.info/?l=squirrelmail-cvs&m=108532891231712
http://rhn.redhat.com/errata/RHSA-2004-240.htmlPatch, Vendor Advisory
http://secunia.com/advisories/11870Patch, Vendor Advisory
http://secunia.com/advisories/12289Patch, Vendor Advisory
http://www.debian.org/security/2004/dsa-535Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200406-08.xmlVendor Advisory
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txtVendor Advisory
http://www.securityfocus.com/advisories/6827Patch, Vendor Advisory
http://www.securityfocus.com/bid/10439Exploit, Patch
https://bugzilla.fedora.us/show_bug.cgi?id=1733Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1012
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10766

Timeline

Published: Aug 18, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-052110.0SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown im CVE-2004-052210.0Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges.CVE-2004-052310.0Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary CVE-2004-052410.0Buffer overflow in the chpasswd command in the Change_passwd plugin before 4.0, as used in SquirrelMail, allows local users to gain root pri CVE-2004-05255.0HP Integrated Lights-Out (iLO) 1.10 and other versions before 1.55 allows remote attackers to cause a denial of service (hang) by accessing CVE-2004-05265.0Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with mo CVE-2004-05275.0KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values CVE-2004-05285.0Netscape Navigator 7.1 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that p CVE-2004-05297.2The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows CVE-2004-05307.2The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local u CVE-2004-05332.1Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to CVE-2004-05344.3Cross-site scripting (XSS) vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows rem