136 matches found
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
Session fixation
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
CVE-2019-16238
CVE-2019-16238 affects Afterlogic Aurora up to version 8.3.9-build-a3, where an XSS vulnerability can be exploited to hijack an administrator session by retrieving the login session cookie. Root cause: insufficient input sanitization enabling script execution in the admin login flow. Impact: pote...
CVE-2019-16238: Improper Neutralization of Input During Web Page Generation
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
AfterLogic Aurora / Webmail XSS Vulnerability (Aug 2017)
AfterLogic Aurora/WebMail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...
AfterLogic Aurora / WebMail Detection (HTTP)
HTTP based detection of AfterLogic Aurora / WebMail. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2017-14597
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
Design/Logic Flaw
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
CVE-2017-14597
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
CVE-2017-14597
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
CVE-2017-14597
Affected software: AfterLogic WebMail 7.7 and Aurora 7.7.5; component: AdminPanel via adminpanel/modules/pro/inc/ajax.php. Issue: cross-site scripting (XSS) vulnerability exploitable via the txtDomainName field during domain addition. Root cause: improper handling of input in the AdminPanel domai...
CVE-2017-14597: Improper Neutralization of Input During Web Page Generation
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
AfterLogic WebMail and Aurora Cross-Site Scripting Vulnerabilities
AfterLogic WebMail and Aurora are both products of AfterLogic, Inc. AfterLogic Aurora is a set of enterprise-class e-mail servers.WebMail is an e-mail client.AdminPanel is one of the back-end management systems. A cross-site scripting vulnerability exists in AfterLogic WebMail version 7.7 and...
AfterLogic WebMail Pro ASP.NET Account Takeover / XXE Injection
No description provided by source...
AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection
AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection 1. ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro...
AfterLogic WebMail Pro ASP.NET Account Takeover / XXE Injection
ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro ASP.NET Class: Sensitive Information disclosure Remotely Exploitable: Yes Versions Affected: AfterLogic WebMail...
AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure (via XXE Injection)
Exploit for asp platform in category web applications 1. ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro ASP.NET Class: Sensitive Information disclosure Remotely...
AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection
ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro ASP.NET Class: Sensitive Information disclosure Remotely Exploitable: Yes Versions Affected: AfterLogic WebMail...