CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-5121
https://notcve.org/view.php?id=CVE-2009-5121
Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session. Websense Email Security anterior a v7.1 Hotfix 4 permite a atacantes remotos evitar la lista negra de remitentes utilizando la palabra clave 8BITMIME EHLO en la sesión SMTP. • http://www.websense.com/support/article/t-kbarticle/Hotfix-4-for-Websense-Email-Security-v7-1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2009-5122
https://notcve.org/view.php?id=CVE-2009-5122
The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query. El componente Personal Email Manager en Websense Email Security anterior a v7.2 permite a atacantes remotos obtener información sensible de la página de estado de JBoss a través de una consulta sin especificar. • http://www.websense.com/content/support/library/email/v72wes/release_notes/WES72_ReleaseNotes.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/78449 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2012-4605
https://notcve.org/view.php?id=CVE-2012-4605
The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data. La configuración por defecto en el componente SMTP en Websense Email Security v6.1 hasta la v7.3 utiliza cifrado SSL débil en la clave de registro en "SurfControl plc\SuperScout Email Filter\SMTP", lo cual hace posible para un atacante remoto obtener información sensible por medio del pinchado de la red y la realización de un ataque por fuerza bruta contra los datos encriptados de la sesión. • http://www.securityfocus.com/bid/64758 http://www.websense.com/support/article/kbarticle/SSL-TLS-weak-and-export-ciphers-detected-in-Websense-Email-Security-deployments https://exchange.xforce.ibmcloud.com/vulnerabilities/78131 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 3CVE-2009-3748 – Websense Email Security - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-3748
Multiple cross-site scripting (XSS) vulnerabilities in the Web Administrator in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allow remote attackers to inject arbitrary web script or HTML via the (1) FileName, (2) IsolatedMessageID, (3) ServerName, (4) Dictionary, (5) Scoring, and (6) MessagePart parameters to web/msgList/viewmsg/actions/msgAnalyse.asp; the (7) Queue, (8) FileName, (9) IsolatedMessageID, and (10) ServerName parameters to actions/msgForwardToRiskFilter.asp and viewHeaders.asp in web/msgList/viewmsg/; and (11) the subject in an e-mail message that is held in a Queue. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Web Administrator en Websense Personal Email Manager v7.1 anteriores a Hotfix v4 y Email Security v7.1 anteriores a Hotfix v4 permite a los atacantes remotos inyectar arbitrariamente una secuencia de comandos web o HTML a través de los parámetros (1) FileName, (2) IsolatedMessageID, (3) ServerName, (4) Dictionary, (5) Scoring, y (6) MessagePart parameters to web/msgList/viewmsg/actions/msgAnalyse.asp; the (7) Queue, (8) FileName, (9) IsolatedMessageID, and (10) ServerName para actions/msgForwardToRiskFilter.asp y viewHeaders.asp en web/msgList/viewmsg/; y (11) el asunto en un mensaje de correo electrónico que se mantiene en una Queue. • https://www.exploit-db.com/exploits/9981 http://kb.websense.com/display/4/kb/article.aspx?aid=4786 http://secunia.com/advisories/37091 http://sotiriu.de/adv/NSOADV-2009-003.txt http://www.securityfocus.com/archive/1/507330/100/0/threaded http://www.securityfocus.com/bid/36741 http://www.vupen.com/english/advisories/2009/2987 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •