CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39600
https://notcve.org/view.php?id=CVE-2023-39600
IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter. Se ha descubierto que IceWarp 11.4.6.0 contiene una vulnerabilidad de Cross-Site Scripting (XSS) a través del parámetro color. • https://icewarp.com https://medium.com/%40katikitala.sushmitha078/cross-site-scripting-reflected-xss-in-icewarp-server-cve-2023-39600-310a7e1c8817 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39700
https://notcve.org/view.php?id=CVE-2023-39700
IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter. Se ha descubierto que IceWarp Mail Server v10.4.5 contiene una vulnerabilidad de Cross-Site Scripting reflejado (XSS) a través del parámetro color. • https://cwe.mitre.org/data/definitions/79.html https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9fehR1yXRJ-y https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_%28XSS%29 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39699
https://notcve.org/view.php?id=CVE-2023-39699
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server. • https://cwe.mitre.org/data/definitions/98.html https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OU https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-36580
https://notcve.org/view.php?id=CVE-2021-36580
Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. • http://icewarp.com http://mail.ziyan.com https://medium.com/%40rohitgautam26/cve-2021-36580-69219798231c • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37728
https://notcve.org/view.php?id=CVE-2023-37728
IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter. • http://icearp.com http://icewarp.com https://medium.com/%40ayush.engr29/cve-2023-37728-6dfb7586311 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •