CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29976
https://notcve.org/view.php?id=CVE-2022-29976
11 May 2022 — An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scripting Reflejado y Autenticado en el parámetro BCC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20BCC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29975
https://notcve.org/view.php?id=CVE-2022-29975
11 May 2022 — An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scriptin Reflejado y Autenticado en el parámetro CC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20CC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 4%CPEs: 1EXPL: 1CVE-2021-27183
https://notcve.org/view.php?id=CVE-2021-27183
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-27182
https://notcve.org/view.php?id=CVE-2021-27182
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27181
https://notcve.org/view.php?id=CVE-2021-27181
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user. Se detectó un problema en MDaemon versiones anteriores... • https://github.com/chudyPB/MDaemon-Advisories • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27180
https://notcve.org/view.php?id=CVE-2021-27180
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 60EXPL: 0CVE-2008-6967
https://notcve.org/view.php?id=CVE-2008-6967
13 Aug 2009 — Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related to cross-site scripting (XSS) and WorldClient DLL 10.0.1, a different vulnerability than CVE-2008-6893. Múltiples vulnerabilidad no especificada en WorldClient en Alt-N MDaemon anteriores a v10.02 tienen impacto desconocido y vector de ataque, probablemente relativo a de ejecución de secuencias de comandos en sitios cruzados - XSS - WorldClient DLL v10.0.1, una vulnerabi... • http://files.altn.com/MDaemon/Release/RelNotes_en.txt •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-3622
https://notcve.org/view.php?id=CVE-2007-3622
09 Jul 2007 — Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service (crash) via malformed messages. Vulnerabilidad no especificada en DomainPOP en Alt-N Technologies MDaemon anterior a 9.61 permite a atacantes remotos provocar denegación de servicio (caida) a través de mensajes malformados. • http://files.altn.com/MDaemon/Release/RelNotes_en.txt •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2006-5968
https://notcve.org/view.php?id=CVE-2006-5968
17 Nov 2006 — MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions. MDaemon 9.0.5, 9.0.6, 9.51, y 9.53, y posiblemente otras versiones, instalan la carpeta de la aplicación MDaemon con permisos no seguros ... • http://secunia.com/advisories/21554 •