CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2017-16962 – CommuniGatePro 6.1.16 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16962
23 Nov 2017 — The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component. Los componentes WebMail (Crystal, pronto y pronto4) en... • https://packetstorm.news/files/id/145095 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 16%CPEs: 2EXPL: 1CVE-2007-2718 – CommuniGate Pro 5.1.8 - Web Mail HTML Injection
https://notcve.org/view.php?id=CVE-2007-2718
16 May 2007 — Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el sistema WebMail de Stalker CommuniGate Pro 5.1.8 y anteriores, utilizando Microsoft Internet Explorer, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante etique... • https://www.exploit-db.com/exploits/30027 •
CVSS: 7.5EPSS: 2%CPEs: 14EXPL: 2CVE-2003-1481 – CommuniGate Pro Webmail 4.0.6 - Session Hijacking
https://notcve.org/view.php?id=CVE-2003-1481
31 Dec 2003 — CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer. • https://www.exploit-db.com/exploits/27 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2002-2375
https://notcve.org/view.php?id=CVE-2002-2375
31 Dec 2002 — Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information. • http://archives.neohapsis.com/archives/bugtraq/2002-07/0016.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •