CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2020-18724 – Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2020-18724
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenado y autenticado en el campo contact name en la lista de distribución de MDaemon webmail versión 19.5.5, permiten a un atacante ejecutar código y llevar a cabo un ataque de tipo XSS mientras abre una lista de contactos Alt-N MDaemon webmail version 20.0.0 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/49536 http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2020-18723 – Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2020-18723
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en el campo file attachment en MDaemon webmail versión 19.5.5, permiten a un atacante ejecutar código en el lado del destinatario del correo electrónico mientras reenvía un correo electrónico para llevar a cabo actividades potencialmente maliciosas Alt-N MDaemon webmail version 20.0.0 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/49537 http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17792 – WorldClient 14 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-17792
MDaemon Webmail (formerly WorldClient) has CSRF. MDaemon Webmail (anteriormente WorldClient) tiene Cross-Site Request Forgery (CSRF). WorldClient version 14 suffers from a cross site request forgery vulnerability. • http://packetstormsecurity.com/files/153686/WorldClient-14-Cross-Site-Request-Forgery.html https://packetstormsecurity.com/files/cve/CVE-2018-17792 https://www.altn.com/Software/MDaemon-Webmail-WorldClient • CWE-352: Cross-Site Request Forgery (CSRF) •