CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29976
https://notcve.org/view.php?id=CVE-2022-29976
An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scripting Reflejado y Autenticado en el parámetro BCC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20BCC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29975
https://notcve.org/view.php?id=CVE-2022-29975
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scriptin Reflejado y Autenticado en el parámetro CC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20CC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27183
https://notcve.org/view.php?id=CVE-2021-27183
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27182
https://notcve.org/view.php?id=CVE-2021-27182
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27181
https://notcve.org/view.php?id=CVE-2021-27181
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN • CWE-352: Cross-Site Request Forgery (CSRF) •