CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16962 – CommuniGatePro 6.1.16 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16962
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component. Los componentes WebMail (Crystal, pronto y pronto4) en CommuniGate Pro en versiones anteriores a la 6.2.1 tienen vulnerabilidades de Cross-Site Scripting (XSS) persistente mediante (1) los campos location o details de una invitación de Google Calendar, (2) una invitación del calendario de Outlook (también conocida como Hotmail Calendar) manipulada, (3) un correo electrónico que proporciona acceso a un directorio que tiene JavaScript en su nombre, (4) JavaScript en un nombre de nota, (5) JavaScript en un nombre de tarea o (6) un correo electrónico HTML que se gestiona de manera incorrecta en el componente Inbox. CommuniGatePro version 6.1.16 suffers from multiple stored cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/43177 https://packetstormsecurity.com/files/145095/communigatepro-xss.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 6%CPEs: 2EXPL: 1CVE-2007-2718 – CommuniGate Pro 5.1.8 - Web Mail HTML Injection
https://notcve.org/view.php?id=CVE-2007-2718
Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el sistema WebMail de Stalker CommuniGate Pro 5.1.8 y anteriores, utilizando Microsoft Internet Explorer, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante etiquetas STYLE manipuladas artesanalmente. • https://www.exploit-db.com/exploits/30027 http://marc.info/?l=full-disclosure&m=117900749209206&w=2 http://osvdb.org/36017 http://secunia.com/advisories/25250 http://www.communigate.com/CommuniGatePro/History51.html http://www.scanit.be/advisory-2007-05-12.html http://www.securityfocus.com/bid/23950 http://www.securitytracker.com/id?1018048 http://www.vupen.com/english/advisories/2007/1795 https://exchange.xforce.ibmcloud.com/vulnerabilities/34266 •
CVSS: 7.5EPSS: 31%CPEs: 14EXPL: 1CVE-2006-0468 – CommuniGate Pro 5.0.6 - Server LDAP Denial of Service
https://notcve.org/view.php?id=CVE-2006-0468
CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite. • https://www.exploit-db.com/exploits/27144 http://secunia.com/advisories/18640 http://www.gleg.net/advisory_cg.shtml http://www.securityfocus.com/archive/1/423364/100/0/threaded http://www.securityfocus.com/bid/16407 http://www.stalker.com/CommuniGatePro/History.html http://www.vupen.com/english/advisories/2006/0364 https://exchange.xforce.ibmcloud.com/vulnerabilities/24409 •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 0CVE-2005-1007
https://notcve.org/view.php?id=CVE-2005-1007
Unknown vulnerability in the LIST functionality in CommuniGate Pro before 4.3c3 allows remote attackers to cause a denial of service (server crash) via certain multipart messages. • http://secunia.com/advisories/14604 http://www.osvdb.org/15257 http://www.stalker.com/CommuniGatePro/History.html https://exchange.xforce.ibmcloud.com/vulnerabilities/19961 •
CVSS: 5.8EPSS: 0%CPEs: 14EXPL: 2CVE-2003-1481 – CommuniGate Pro Webmail 4.0.6 - Session Hijacking
https://notcve.org/view.php?id=CVE-2003-1481
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer. • https://www.exploit-db.com/exploits/27 http://securityreason.com/securityalert/3290 http://www.securityfocus.com/archive/1/320438 http://www.securityfocus.com/bid/7501 https://exchange.xforce.ibmcloud.com/vulnerabilities/11932 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •