The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports SquirrelMail: DoS (disk space consumption) by random IMAP login attempts with 8-bit characters in the password SquirrelMail: Prone to clickjacking attacks SquirrelMail: Multiple XSS flaws SquirrelMail: XSS in <style> tag handling SquirrelMail: CRLF injection vulnerability SquirrelMail: CSRF in the empty trash feature and in Index Order page