CVSS: 7.8EPSS: 90%CPEs: 1EXPL: 3CVE-2015-1503 – IceWarp Mail Server < 11.1.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2015-1503
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php. Múltiples vulnerabilidades de salto de directorio en IceWarp Mail Server en versiones anteriores a la 11.2 permiten que atacantes remotos lean archivos arbitrarios mediante (1) un .. (punto punto) en el parámetro file en una página webmail/client/skins/default/css/css.php o .../. • https://www.exploit-db.com/exploits/44587 http://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 2%CPEs: 20EXPL: 4CVE-2011-3579 – IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure
https://notcve.org/view.php?id=CVE-2011-3579
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference. server/webmail.php en IceWarp WebMail en el servidor de correo IceWarp anteriores a v10.3.3 permite a atacantes remotos leer ficheros arbitrarios, y posiblemente enviar peticiones HTTP a los servidores de la intranet o causar una denegación de servicio (Agotamiento de CPU y de memoria), a través de una entidad externa XML declaración en relación con una referencia de entidad. IceWarp Mail Server versions 10.3.2 and below suffer from XML external entity injection and PHP information disclosure vulnerabilities. • https://www.exploit-db.com/exploits/36165 http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html http://securityreason.com/securityalert/8404 http://securitytracker.com/id?1026093 http://www.osvdb.org/75721 http://www.securityfocus.com/bid/49753 https://exchange.xforce.ibmcloud.com/vulnerabilities/70025 https://www.trustwave.com/spiderlabs/advisories/TWSL2011-013.txt • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 3%CPEs: 20EXPL: 3CVE-2011-3580 – IceWarp Mail Server Injection / Information Disclosure
https://notcve.org/view.php?id=CVE-2011-3580
IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function. IceWarp WebMail en el servidor de correo IceWarp anterirores a v10.3.3 permite a atacantes remotos obtener información de configuración a través de una petición directa a la URI /server, lo que provoca una llamada a la función phpinfo. IceWarp Mail Server versions 10.3.2 and below suffer from XML external entity injection and PHP information disclosure vulnerabilities. • http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html http://securityreason.com/securityalert/8404 http://securitytracker.com/id?1026093 http://www.osvdb.org/75722 http://www.securityfocus.com/bid/49753 https://exchange.xforce.ibmcloud.com/vulnerabilities/70026 https://www.trustwave.com/spiderlabs/advisories/TWSL2011-013.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-5734
https://notcve.org/view.php?id=CVE-2008-5734
Cross-site scripting (XSS) vulnerability in WebMail Pro in IceWarp Software Merak Mail Server 9.3.2 allows remote attackers to inject arbitrary web script or HTML via an IMG element in an HTML e-mail message. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebMail Pro en IceWarp Software Merak Mail Server 9.3.2 permite a atacantes remotos inyectar secuencias de comandos web de su elección o HTML mediante un elementos IMG en un mensaje e-mail en formato HTML. • http://blog.vijatov.com/index.php?itemid=11 http://osvdb.org/50885 http://secunia.com/advisories/32770 http://www.securityfocus.com/bid/32969 https://exchange.xforce.ibmcloud.com/vulnerabilities/47533 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-2049
https://notcve.org/view.php?id=CVE-2008-2049
The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information via multiple crafted APOP commands for a known POP3 account, which displays the password in a POP3 error message. El servidor POP3 (EPSTPOP3S.EXE) 4.22 en E-Post Mail Server 4.10 permite a atacantes remotos conseguir información sensible a través de múltiples comandos APOP manipulados para una cuenta POP3 conocida, la cual mostrará la contraseña en un mensaje de error del POP3. • http://secunia.com/advisories/29990 http://vuln.sg/epostmailserver410-en.html http://www.e-postinc.jp/Mail_Server.html http://www.securityfocus.com/bid/28951 http://www.securitytracker.com/id?1019930 http://www.vupen.com/english/advisories/2008/1389/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42035 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •