CVSS: 6.1EPSS: 2%CPEs: 109EXPL: 3CVE-2010-3201 – Surgemail SurgeWeb 4.3e - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-3201
07 Jan 2011 — Cross-site scripting (XSS) vulnerability in NetWin Surgemail before 4.3g allows remote attackers to inject arbitrary web script or HTML via the username_ex parameter to the surgeweb program. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en NetWin Surgemail anterirores a v4.3g permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro username_ex sobre el programa surgeweb. • https://www.exploit-db.com/exploits/34797 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 22EXPL: 1CVE-2008-2859 – Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
https://notcve.org/view.php?id=CVE-2008-2859
25 Jun 2008 — Unspecified vulnerability in the IMAP service in NetWin SurgeMail before 3.9g2 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors related to an "imap command." Vulnerabilidad no especificada en el servicio de IMAP en NetWin SurgeMail anterior a 3.9g2; permite a atacantes remotos provocar una denegación de servicio (caída del demonio) mediante vectores desconocidos relacionados con un "comando imap". • https://www.exploit-db.com/exploits/5968 •
CVSS: 9.0EPSS: 7%CPEs: 1EXPL: 1CVE-2008-1498 – NetWin Surgemail 3.8k4-4 - IMAP (Authenticated) Remote LIST Universal
https://notcve.org/view.php?id=CVE-2008-1498
25 Mar 2008 — Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long first argument to the LIST command. Desbordamiento de búfer basado en Pila en el servicio IMAP de NetWin SurgeMail 38k4-4 y versiones anteriores, permite a usuarios remotos autenticados ejecutar código de su elección mediante un primer argumento largo del comando LIST. • https://www.exploit-db.com/exploits/5259 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 21%CPEs: 25EXPL: 2CVE-2008-1055 – Surgemail and WebMail 3.0 - 'Page' Remote Format String
https://notcve.org/view.php?id=CVE-2008-1055
27 Feb 2008 — Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter. Vulnerabilidad de cadena de formato en webmail.exe de NetWin SurgeMail 38k4 y versiones anteriores y beta 39a, y WebMail 3.1s y versiones anteriores, permite a atacantes remotos provocar una denegación de servicio (caída del demonio... • https://www.exploit-db.com/exploits/31300 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 6.1EPSS: 11%CPEs: 9EXPL: 5CVE-2004-2548 – NetWin Surgemail 1.8/1.9/2.0 / WebMail 3.1 - Login Form Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2004-2548
31 Dec 2004 — Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547). • https://www.exploit-db.com/exploits/24177 •
CVSS: 5.3EPSS: 16%CPEs: 46EXPL: 5CVE-2004-2547 – NetWin Surgemail 1.8/1.9/2.0 / WebMail 3.1 - Error Message Full Path Disclosure
https://notcve.org/view.php?id=CVE-2004-2547
31 Dec 2004 — NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message. • https://www.exploit-db.com/exploits/24176 •