CVSS: 6.5EPSS: 0%CPEs: 176EXPL: 3CVE-2009-1468 – IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2009-1468
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query. Múltiples vulnerabilidades de inyección SQL en el formulario de búsqueda en server/webmail.php en el componente Groupware en IceWarp eMail Server y WebMail Server anteriores a v9.4.2 permite a usuarios remotos autenticados ejecutar comandos SQL de forma arbitraria a través de los elementos (1) sql y (2) order_by en un petición de búsqueda XML. RedTeam Pentesting discovered a remote SQL injection vulnerability in the Groupware component of IceWarp WebMail Server version 9.4.1. • https://www.exploit-db.com/exploits/32968 http://osvdb.org/54228 http://www.redteam-pentesting.de/advisories/rt-sa-2009-003 http://www.securityfocus.com/archive/1/503226/100/0/threaded http://www.securityfocus.com/bid/34820 http://www.securitytracker.com/id?1022169 http://www.vupen.com/english/advisories/2009/1253 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 1%CPEs: 176EXPL: 4CVE-2009-1467 – IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1467
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en IceWarp eMail Server y WebMail Server anteriores a v9.4.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a través de (1) el cuerpo del mensaje, relacionado con la vista del correo electrónico y el incorrecto filtrado HTML en la función "cleanHTML" en server/inc/tools.php; o (2) el titulo, (3) enlace o (4)el elemento descripción en un RSS, relacionado con la función gerHTML en server/inc/rss/item.php. RedTeam Pentesting discovered a cross site scripting vulnerability in the RSS Feed Reader functionality of the IceWarp WebMail Server version 9.4.1. • https://www.exploit-db.com/exploits/32969 https://www.exploit-db.com/exploits/32985 http://osvdb.org/54226 http://osvdb.org/54227 http://www.redteam-pentesting.de/advisories/rt-sa-2009-001 http://www.redteam-pentesting.de/advisories/rt-sa-2009-002 http://www.securityfocus.com/archive/1/503225/100/0/threaded http://www.securityfocus.com/archive/1/503229/100/0/threaded http://www.securityfocus.com/bid/34825 http://www.securitytracker.com/id?1022167 http://www. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 176EXPL: 2CVE-2009-1469 – IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation
https://notcve.org/view.php?id=CVE-2009-1469
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message. Vulnerabilidad de inyección CRLF en la implementación Forgot Password en server/webmail.php en IceWarp eMail Server y WebMail Server anterior a v9.4.2 hace mas facil para atacantes remotos engañar a un usuario para la revelación de credenciales a través de secuencias CRLF precediendo una cabecera de respuesta en el elemento "subject" de un documento XML, como se demostró mediante el envío de un mensaje de correo electrónico que contenga las credenciales de usuario desde el servidor, las peticiones para componer la respuesta al usuario, incluyen este mensaje. RedTeam Pentesting discovered that the emails sent by the IceWarp WebMail Server when using the "Forgot Password" function are generated on the client side. Version 9.4.1 is affected. • https://www.exploit-db.com/exploits/32986 http://osvdb.org/54229 http://www.redteam-pentesting.de/advisories/rt-sa-2009-004 http://www.securityfocus.com/archive/1/503227/100/0/threaded http://www.securityfocus.com/bid/34827 http://www.securitytracker.com/id?1022166 http://www.vupen.com/english/advisories/2009/1253 https://exchange.xforce.ibmcloud.com/vulnerabilities/50332 • CWE-94: Improper Control of Generation of Code ('Code Injection') •