CVSS: 8.1EPSS: 5%CPEs: 57EXPL: 0CVE-2011-1506
https://notcve.org/view.php?id=CVE-2011-1506
22 Mar 2011 — The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information. La implementación STARTTLS en Kerio Connect v7.1.4 build 2985 y MailServ... • http://secunia.com/advisories/43678 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2009-2636
https://notcve.org/view.php?id=CVE-2009-2636
28 Jul 2009 — Cross-site scripting (XSS) vulnerability in the Integration page in the WebMail component in Kerio MailServer 6.6.0, 6.6.1, 6.6.2, and 6.7.0 allows remote attackers to inject arbitrary web script or HTML via an e-mail message. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la página Integration en el componente WebMail en Kerio MailServer v6.6.0, v6.6.1, v6.6.2, y v6.7.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a través de ... • http://osvdb.org/54928 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •