CVE-2006-4169
published 2007-07-15CVE-2006-4169: Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to…
PriorityP425medium5.5CVSS 2.0
AVNACLAuSCPIPAN
EPSS
1.62%
73.0th percentile
Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the help parameter to (1) gpg_help.php or (2) gpg_help_base.php.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| squirrelmail | gpg_plugin | — | — |
| squirrelmail | gpg_plugin | — | — |
| squirrelmail | squirrelmail | — | — |
CVSS provenance
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2007-3635: Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2
vendor_redhat·CVSS 9.3
CVE-2007-3635 [CRITICAL] CVE-2007-3635: Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634.
Statement: Not vulnerable. This plugin is not shipped with Squirrelmail in Red Hat Enterprise Linux.
GHSA
GHSA-qxqw-pch2-xr57: Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2
ghsa_unreviewed·2022-05-01·CVSS 9.3
CVE-2007-3635 [CRITICAL] GHSA-qxqw-pch2-xr57: Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634.
GHSA
GHSA-rjqq-xg2f-4c6w: Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2
ghsa_unreviewed·2022-05-01
CVE-2006-4169 [MEDIUM] GHSA-rjqq-xg2f-4c6w: Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2
Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the help parameter to (1) gpg_help.php or (2) gpg_help_base.php.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=555http://osvdb.org/37932http://osvdb.org/37933http://secunia.com/advisories/26035http://secunia.com/advisories/26424http://security.gentoo.org/glsa/glsa-200708-08.xmlhttp://www.securityfocus.com/bid/24874http://www.vupen.com/english/advisories/2007/2513https://exchange.xforce.ibmcloud.com/vulnerabilities/35362http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=555http://osvdb.org/37932http://osvdb.org/37933http://secunia.com/advisories/26035http://secunia.com/advisories/26424http://security.gentoo.org/glsa/glsa-200708-08.xmlhttp://www.securityfocus.com/bid/24874http://www.vupen.com/english/advisories/2007/2513https://exchange.xforce.ibmcloud.com/vulnerabilities/35362
2007-07-15
Published