CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 3CVE-2014-3878 – IPSwitch IMail Server WEB client 12.4 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-3878
Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in an add new contact action in the Contacts section or unspecified vectors in (2) an Add Group task in the Contacts section, (3) an add new event action in the Calendar section, or (4) the Task section. Múltiples vulnerabilidades de XSS en la interfaz de cliente web en Ipswitch IMail Server 12.3 y 12.4, posiblemente anterior a 12.4.1.15, permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbirarios a través de (1) el campo Name en una acción de añadir nuevo contacto en la sección Contacts o vectores no especificados en (2) una tarea Add Group en la sección Contacts, (3) una acción de añadir nuevo contacto en la sección Calendar o (4) la sección Task. IPSwitch IMail server web client versions 12.3 and 12.4 before 12.4.1.15 suffer from a persistent cross site scripting vulnerability. • https://www.exploit-db.com/exploits/33633 http://packetstormsecurity.com/files/126948/IPSwitch-IMail-12.4-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2014/Jun/19 http://www.exploit-db.com/exploits/33633 http://www.securityfocus.com/bid/67830 http://www.securitytracker.com/id/1030335 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2012-4344 – ipswitch whatsup gold 15.02 - Persistent Cross-Site Scripting / Blind SQL Injection / Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-4344
Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the SNMP system name of the attacking host. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Ipswitch WhatsUp Gold v15.02 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados relacionados con el nombre del sistema SNMP de la máquina atacante. • https://www.exploit-db.com/exploits/20035 http://www.exploit-db.com/exploits/20035 http://www.kb.cert.org/vuls/id/777007 https://exchange.xforce.ibmcloud.com/vulnerabilities/77150 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2012-2601 – ipswitch whatsup gold 15.02 - Persistent Cross-Site Scripting / Blind SQL Injection / Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-2601
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute arbitrary SQL commands via the sGroupList parameter. Vulnerabilidad de inyección de comandos SQL en WrVMwareHostList.asp in Ipswitch WhatsUp Gold v15.02 permite a atacantes remotos ejecutar comandos SQL a través del parámetro sGroupList. Ipswitch WhatsUp Gold version 15.02 suffers from code execution, cross site scripting, and remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/20035 http://www.exploit-db.com/exploits/20035 http://www.kb.cert.org/vuls/id/777007 http://www.securityfocus.com/bid/54626 http://www.securitytracker.com/id?1027325 http://www.whatsupgold.com/blog/2012/07/23/keeping-whatsup-gold-secure https://exchange.xforce.ibmcloud.com/vulnerabilities/77152 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 47EXPL: 0CVE-2011-1430
https://notcve.org/view.php?id=CVE-2011-1430
The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. La implementación del servidor Ipswitch IMail v11.03 no restringe el búfer I/O de forma adecuada, lo que permite a los atacantes "man-in-the-middle insertar comandos en las sesiones SMTP cifrado mediante el envío de un comando de texto plano que se procesa después de que TLS está en su lugar, relacionado con un ataque "inyección de de comando en texto claro", un problema similar a CVE -2011- 0411. • http://secunia.com/advisories/43676 http://www.kb.cert.org/vuls/id/555316 http://www.kb.cert.org/vuls/id/MAPG-8DBRD4 http://www.osvdb.org/71020 http://www.securityfocus.com/bid/46767 http://www.vupen.com/english/advisories/2011/0609 https://exchange.xforce.ibmcloud.com/vulnerabilities/65932 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 2%CPEs: 4EXPL: 4CVE-2009-4775 – Ipswitch WS_FTP 12 Professional - Remote Format String (PoC)
https://notcve.org/view.php?id=CVE-2009-4775
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response. Vulnerabilidad de formato de cadena en Ipswitch WS_FTP Professional v12 anterior a v12.2, permite a atacantes remotos provocar una denegación de servicio (caída) a través de especificadores de formato de cadena en el "status code" de una respuesta HTTP. • https://www.exploit-db.com/exploits/9607 http://docs.ipswitch.com/WS_FTP%20122/ReleaseNotes/English/index.htm?k_id=ipswitch_com_ftp_documents_worldwide_ws_ftp122releasenotesenglish#link23 http://www.exploit-db.com/exploits/9607 http://www.packetstormsecurity.org/0909-exploits/nocoolnameforawsftppoc.pl.txt http://www.securityfocus.com/bid/36297 https://exchange.xforce.ibmcloud.com/vulnerabilities/53098 • CWE-134: Use of Externally-Controlled Format String •