CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7855
https://notcve.org/view.php?id=CVE-2017-7855
31 Aug 2017 — In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter. El el componente webmail en IceWarp Server 11.3.1.5, existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el parámetro language. • https://technical.nttsecurity.com/post/102eegq/cookies-are-delicious • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12844
https://notcve.org/view.php?id=CVE-2017-12844
23 Aug 2017 — Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name. Una vulnerabilidad Cross-Site Scripting (XSS) en en panel de administrador en IceWarp Mail Server 10.4.4 permite que administradores del dominio remotos autenticados inyecten scripts web o HTLM arbitrarios mediante un nombre de usuario manipulado. • https://youtu.be/MI4dhEia1d4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 20EXPL: 3CVE-2011-3580
https://notcve.org/view.php?id=CVE-2011-3580
30 Sep 2011 — IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function. IceWarp WebMail en el servidor de correo IceWarp anterirores a v10.3.3 permite a atacantes remotos obtener información de configuración a través de una petición directa a la URI /server, lo que provoca una llamada a la función phpinfo. • http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 17%CPEs: 20EXPL: 4CVE-2011-3579 – IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure
https://notcve.org/view.php?id=CVE-2011-3579
30 Sep 2011 — server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference. server/webmail.php en IceWarp WebMail en el servidor de correo IceWarp anteriores a v10.3.3 permite a atacantes remotos leer ficheros arbitrarios, y posiblemente enviar peticiones HTTP a los servid... • https://www.exploit-db.com/exploits/36165 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 6%CPEs: 176EXPL: 4CVE-2009-1467 – IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1467
05 May 2009 — Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (X... • https://www.exploit-db.com/exploits/32969 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 176EXPL: 3CVE-2009-1468 – IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2009-1468
05 May 2009 — Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query. Múltiples vulnerabilidades de inyección SQL en el formulario de búsqueda en server/webmail.php en el componente Groupware en IceWarp eMail Server y WebMail Server anteriores a v9.4.2 permite a usuarios remotos autent... • https://www.exploit-db.com/exploits/32968 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 5%CPEs: 176EXPL: 2CVE-2009-1469 – IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation
https://notcve.org/view.php?id=CVE-2009-1469
05 May 2009 — CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message. Vulnerabilidad de... • https://www.exploit-db.com/exploits/32986 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 2CVE-2009-1516 – Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2009-1516
04 May 2009 — Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method, as possibly demonstrated by a web application that accepts untrusted input for this method. Desbordamiento de búfer en el control ActiveX en IceWarpServer.APIObject en api.dll en IceWarp Merak Mail Server v9.4.1, permite a atacantes, dependiendo del co... • https://www.exploit-db.com/exploits/8542 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-5734
https://notcve.org/view.php?id=CVE-2008-5734
26 Dec 2008 — Cross-site scripting (XSS) vulnerability in WebMail Pro in IceWarp Software Merak Mail Server 9.3.2 allows remote attackers to inject arbitrary web script or HTML via an IMG element in an HTML e-mail message. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebMail Pro en IceWarp Software Merak Mail Server 9.3.2 permite a atacantes remotos inyectar secuencias de comandos web de su elección o HTML mediante un elementos IMG en un mensaje e-mail en formato HTML. • http://blog.vijatov.com/index.php?itemid=11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2007-5046
https://notcve.org/view.php?id=CVE-2007-5046
24 Sep 2007 — Cross-site scripting (XSS) vulnerability in the Webmail interface for IceWarp Merak Mail Server before 9.0.0 allows remote attackers to inject arbitrary JavaScript via a javascript: URI in an attribute of an element in an email message body, as demonstrated by the onload attribute in a BODY element. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en la interfaz Webmail para ceWarp Merak Mail Server anterior a 9.0.0 permite a atacantes remotos inyectar JavaScript de su elección a través de u... • http://osvdb.org/37428 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •