CVE-2001-1159

load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.

• http://archives.neohapsis.com/archives/bugtraq/2001-07/0029.htmlPatch, Vendor Advisory
• http://www.iss.net/security_center/static/6775.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/2968Patch, Vendor Advisory
• http://www.squirrelmail.org/changelog.php
• http://archives.neohapsis.com/archives/bugtraq/2001-07/0029.htmlPatch, Vendor Advisory
• http://www.iss.net/security_center/static/6775.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/2968Patch, Vendor Advisory
• http://www.squirrelmail.org/changelog.php

Published

Jul 2, 2001

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2001-1153lpsystem in OpenUnix 8.0.0 allows local users to cause a den…
• CVE-2001-1154Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enab…
• CVE-2001-1155TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 wit…9.8
• CVE-2001-1156TYPSoft FTP 0.95 allows remote attackers to cause a denial o…
• CVE-2001-1157Baltimore Technologies WEBsweeper 4.0 and 4.02 does not prop…
• CVE-2001-1158Check Point VPN-1/FireWall-1 4.1 base.def contains a default…
• CVE-2001-1160udirectory.pl in Microburst Technologies uDirectory 2.0 and …
• CVE-2001-1161Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0…
• CVE-2001-1162Directory traversal vulnerability in the %m macro in the smb…
• CVE-2001-1163Buffer overflow in Munica Corporation NetSQL 1.0 allows remo…
• CVE-2001-1164Buffer overflow in uucp utilities in UnixWare 7 allows local…
• CVE-2001-1165Intego FileGuard 4.0 uses weak encryption to store user info…