CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16962 – CommuniGatePro 6.1.16 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16962
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component. Los componentes WebMail (Crystal, pronto y pronto4) en CommuniGate Pro en versiones anteriores a la 6.2.1 tienen vulnerabilidades de Cross-Site Scripting (XSS) persistente mediante (1) los campos location o details de una invitación de Google Calendar, (2) una invitación del calendario de Outlook (también conocida como Hotmail Calendar) manipulada, (3) un correo electrónico que proporciona acceso a un directorio que tiene JavaScript en su nombre, (4) JavaScript en un nombre de nota, (5) JavaScript en un nombre de tarea o (6) un correo electrónico HTML que se gestiona de manera incorrecta en el componente Inbox. CommuniGatePro version 6.1.16 suffers from multiple stored cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/43177 https://packetstormsecurity.com/files/145095/communigatepro-xss.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 4%CPEs: 2EXPL: 1CVE-2007-2718 – CommuniGate Pro 5.1.8 - Web Mail HTML Injection
https://notcve.org/view.php?id=CVE-2007-2718
Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el sistema WebMail de Stalker CommuniGate Pro 5.1.8 y anteriores, utilizando Microsoft Internet Explorer, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante etiquetas STYLE manipuladas artesanalmente. • https://www.exploit-db.com/exploits/30027 http://marc.info/?l=full-disclosure&m=117900749209206&w=2 http://osvdb.org/36017 http://secunia.com/advisories/25250 http://www.communigate.com/CommuniGatePro/History51.html http://www.scanit.be/advisory-2007-05-12.html http://www.securityfocus.com/bid/23950 http://www.securitytracker.com/id?1018048 http://www.vupen.com/english/advisories/2007/1795 https://exchange.xforce.ibmcloud.com/vulnerabilities/34266 •
CVSS: 5.8EPSS: 0%CPEs: 14EXPL: 2CVE-2003-1481 – CommuniGate Pro Webmail 4.0.6 - Session Hijacking
https://notcve.org/view.php?id=CVE-2003-1481
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer. • https://www.exploit-db.com/exploits/27 http://securityreason.com/securityalert/3290 http://www.securityfocus.com/archive/1/320438 http://www.securityfocus.com/bid/7501 https://exchange.xforce.ibmcloud.com/vulnerabilities/11932 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2002-2375
https://notcve.org/view.php?id=CVE-2002-2375
Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information. • http://archives.neohapsis.com/archives/bugtraq/2002-07/0016.html http://www.iss.net/security_center/static/9463.php • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2000-1002 – PragmaSys TelnetServer 2000 - rexec Buffer Overflow
https://notcve.org/view.php?id=CVE-2000-1002
POP3 daemon in Stalker CommuniGate Pro 3.3.2 generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to determine valid email addresses on the server for SPAM attacks. • https://www.exploit-db.com/exploits/20175 http://www.securityfocus.com/archive/1/139523 http://www.securityfocus.com/bid/1792 https://exchange.xforce.ibmcloud.com/vulnerabilities/5363 •