IceWarp webmail/basic/index.html _c Parameter Directory Traversal

The version of IceWarp installed on the remote host is affected by a directory traversal vulnerability because the application fails to properly sanitize user-supplied input to the 'c' parameter of the '/webmail/basic/index.html' script. An attacker could leverage this issue to read arbitrary fil...

Merak Mail Server Web Mail Detection (HTTP)

HTTP based detection of Merak Mail Server. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

IceWarp Merak Mail Server < 9.4.2 Multiple Vulnerabilities

IceWarp Merak Mail Server is prone to multiple vulnerabilities. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

IceWarp Merak WebMail Server < 9.4.2 Multiple Vulnerabilities

The remote host is running IceWarp WebMail Server - a webmail server for Windows and Linux. According to its banner, the version of IceWarp installed on the remote host is earlier than 9.4.2. Such versions may reportedly be affected by multiple vulnerabilities : - A SQL injection vulnerability...

IceWarp WebMail口令取回功能输入验证漏洞

BUGTRAQ ID: 34827 CVECAN ID: CVE-2009-1469 Merak Email Server是一个全面的办公室局域网或Internet通讯邮件解决方案。 Merak邮件服务器的WebMail模块在登陆页面提供了“忘记口令”取回功能，忘记了登录口令的用户可以在这里向邮件服务器提供他们的邮件地址，之后服务器检查系统中是否存在这个地址并将相关的用户口令发回到这个地址。 在点击Forgot Password页面的提交按键时，所发送的HTTP POST请求包含有类似于以下的负载：...

Merak邮件服务器RSS源阅读器跨站脚本漏洞

BUGTRAQ ID: 34825 CVECAN ID: CVE-2009-1467 Merak Email Server是一个全面的办公室局域网或Internet通讯邮件解决方案。 Merak邮件服务器的WebMail用户可以向其文件夹列表中添加RSS源作为文件夹，这些源是由html/webmail/server/inc /rss/rss.php文件解析的，并在html/webmail/server/inc/rss/item.php文件中处理RSS channel中的每个item元素。...

CVE-2009-1467

Multiple cross-site scripting XSS vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in...

CVE-2009-1469

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element o...

Crlf injection

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element o...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in...

CVE-2009-1468

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...

CVE-2009-1467

Multiple cross-site scripting XSS vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in...

CVE-2009-1469

IceWarp eMail Server/WebMail Server (before 9.4.2) contains a CRLF injection flaw in Forgot Password handling that can trick users into disclosing credentials. The vulnerability arises from CRLF sequences preceding a Reply-To header in the subject of an XML-driven message, enabling social-enginee...

CVE-2009-1468

IceWarp eMail Server / WebMail Server prior to version 9.4.2 contains SQL injection vulnerabilities in the webmail groupware search (server/webmail.php). The flaws allow remote authenticated users to manipulate SQL through the sql and order_by elements within an XML search query, enabling arbitra...

CVE-2009-1467

CVE-2009-1467 affects IceWarp WebMail Server and IceWarp eMail Server prior to version 9.4.2. The vulnerability is an XSS flaw in RSS feed handling and email view: the RSS feed item’s title and href are inserted unmodified, while the description is sanitized via cleanHTML, per the getHTML and RSS...

CVE-2009-1468

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...

CVE-2009-1469

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element o...

IceWarp Merak Mail Server 9.4.1 - item.php Cross-Site Scripting

IceWarp Merak Mail Server 9.4.1 - item.php Cross-Site Scripting source: https://www.securityfocus.com/bid/34825/info IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this iss...

IceWarp Merak Mail Server 9.4.1 - cleanHTML() Cross-Site Scripting

IceWarp Merak Mail Server 9.4.1 - cleanHTML Cross-Site Scripting source: https://www.securityfocus.com/bid/34823/info IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this...

[RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted Cross Site Scripting attacks in its RSS feed reader. If attackers control or compromise an RSS...