10 results (0.012 seconds)

CVSS: 10.0EPSS: 6%CPEs: 1EXPL: 2

CVE-2023-48974 – Axigen < 10.5.7 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2023-48974

08 Feb 2024 — Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter. Vulnerabilidad de cross-site scripting en Axigen WebMail v.10.5.7 y anteriores permite a un atacante remoto escalar privilegios a través de un script manipulado al parámetro serverName_input. • https://www.exploit-db.com/exploits/51963 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-23566

https://notcve.org/view.php?id=CVE-2023-23566

13 Jan 2023 — A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service (or add an account to Outlook or Gmail, etc.) with IMAP or POP3 without any verification code. Un problema de verificación en dos pasos en Axigen 10.3.3.52 permite a un atacante acceder a un buzón omitiendo la verificación en dos pasos cuando intenta agregar una cuenta a cualquier servicio de correo web de terceros (o agr... • https://github.com/umz-cert/vulnerabilities/issues/1 • CWE-276: Incorrect Default Permissions •

CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0

CVE-2015-5379 – Axigen Cross Site Scripting

https://notcve.org/view.php?id=CVE-2015-5379

21 Jul 2015 — Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment. Vulnerabilidad Cross-Site Scripting (XSS) en actions.hsp en la interfaz de Ajax WebMail en AXIGEN Mail Server en versiones anteriores a la 9.0 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante un archivo adjunto en un correo. Axigen's WebMail Ajax interface implements a view ... • http://packetstormsecurity.com/files/132764/Axigen-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2012-2592 – Axigen Mail Server 8.0.1 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-2592

18 Jun 2014 — Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email. Vulnerabilidad de XSS en Axigen Mail Server 8.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del cuerpo de un email. • https://www.exploit-db.com/exploits/20348 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 55EXPL: 1

CVE-2010-3459

https://notcve.org/view.php?id=CVE-2010-3459

17 Sep 2010 — Cross-site scripting (XSS) vulnerability in the Ajax WebMail interface in AXIGEN Mail Server before 7.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la interfaz Ajax Webmail en AXIGEN Mail Server anterior a v7.4.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://secunia.com/advisories/41430 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 10%CPEs: 56EXPL: 3

CVE-2010-3460 – Axigen Webmail 1.0.1 - Directory Traversal

https://notcve.org/view.php?id=CVE-2010-3460

17 Sep 2010 — Directory traversal vulnerability in the HTTP interface in AXIGEN Mail Server 7.4.1 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL. Vulnerabilidad de salto de directorio en la interfaz HTTP en AXIGEN Mail Server v7.4.1 para Windows permite a atacantes remotos leer archivos a su elección a través de un %5C (barra invertida codificada) en la URL. • https://www.exploit-db.com/exploits/34622 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2009-1484

https://notcve.org/view.php?id=CVE-2009-1484

29 Apr 2009 — Cross-site scripting (XSS) vulnerability in the web mail interface feature in AXIGEN Mail Server 6.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving e-mail messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función del interfaz de correo web en AXIGEN Mail Server 6.2.2 permite a atacantes remotos inyectar HTML o s... • http://secunia.com/advisories/34402 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 19%CPEs: 1EXPL: 3

CVE-2008-0434 – Axigen 5.0.2 - AXIMilter Remote Format String

https://notcve.org/view.php?id=CVE-2008-0434

23 Jan 2008 — Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format string specifiers in the CNHO command. Vulnerabilidad de cadena de formato en el módulo AXIMilter de AXIGEN Mail Server 5.0.2 permite a atacantes remotos ejecutar código de su elección mediante especificadores de cadena de formato en el comando CNHO. • https://www.exploit-db.com/exploits/4947 • CWE-189: Numeric Errors •

CVSS: 10.0EPSS: 26%CPEs: 2EXPL: 1

CVE-2007-0886 – Axigen 2.0.0b1 - Remote Denial of Service

https://notcve.org/view.php?id=CVE-2007-0886

12 Feb 2007 — Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via certain base64-encoded data on the pop3 port (110/tcp), which triggers an integer overflow. Desbordamiento de búfer basado en montón en axigen 1.2.6 hasta 2.0.0b1 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección mediante determinados datos codificados en ... • https://www.exploit-db.com/exploits/3289 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 7.8EPSS: 13%CPEs: 2EXPL: 1

CVE-2007-0887 – Axigen 2.0.0b1 - Remote Denial of Service

https://notcve.org/view.php?id=CVE-2007-0887

12 Feb 2007 — axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a base64-encoded "*\x00" sequence on the imap port (143/tcp). axigen 1.2.6 hasta 2.0.0b1 no analiza adecuadamente las credenciales de acceso, lo cual permite a atacantes remotos provocar una denegación de servicio (referencia a NULL y cierre de aplicación) mediante una secuencia en base-64 "*\x00" en el puerto imap (143/tcp). • https://www.exploit-db.com/exploits/3290 • CWE-476: NULL Pointer Dereference •