Sergey Scherbel

The issue allows remote attackers to bypass intended restrictions on filename extensions for created files. This is achieved by including a %00 sequence in a pathname within an HTTP request.

The issue is related to an "HTTP Parameter Contamination" problem, where unspecified characters in variable names are not handled properly. This has unknown impact and can be exploited remotely.

The issue allows overwriting entries in the SERVER superglobal array based on POST parameters, which has unspecified impact and can be exploited remotely.

The issue is related to the improper implementation of the `==` operator for comparisons in Caucho Quercus, which has unspecified impact and context-dependent attack vectors.

A directory traversal issue allows remote attackers to create files in arbitrary directories by including a .. (dot dot) in a pathname within an HTTP request.

The issue allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension. This leads to the creation of an executable file under tmp/.

The issue concerns the compose.php file in the @Mail WebMail Client, which does not properly handle ../ (dot dot slash) sequences in the `unique` parameter. This allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .././ (dot dot dot slash dot slash) sequence.

The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities are located in the compose.php and libs/Atmail/SendMsg.php files of the @Mail WebMail Client in AtMail Open-Source. Remote attackers can exploit this issue by using a .. (dot dot) in the `Attachment[]` parameter to read arbitrary files.

The issue concerns a CRLF injection vulnerability in the mime.php file of the @Mail WebMail Client. This vulnerability allows remote attackers to conduct directory traversal attacks and read arbitrary files by including a %0A sequence followed by a .. (dot dot) in the `file` parameter.

The issue allows remote attackers to obtain configuration information by making a direct request to "install/info.php", which calls the `phpinfo()` function.