IceWarp WebMail RSS Feed XSS

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted Cross Site Scripting attacks in its RSS feed reader. If attackers control or compromise an RSS...

IceWarp WebMail SQL Injection

Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in the IceWarp WebMail Server. Attackers that are in control of a user account for the web-based email and groupware components are able to execut...

IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections

IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections source: https://www.securityfocus.com/bid/34820/info IceWarp Merak Mail Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL...

IceWarp WebMail Mail Forgery

Advisory: IceWarp WebMail Server: Client-Side Specification of "Forgot Password" eMail Content During a penetration test, RedTeam Pentesting discovered that the emails sent by the IceWarp WebMail Server when using the "Forgot Password" function are generated on the client side. Furthermore, the...

IceWarp Merak Mail Server 9.4.1 - Forgot Password Input Validation

IceWarp Merak Mail Server 9.4.1 - Forgot Password Input Validation source: https://www.securityfocus.com/bid/34827/info IceWarp Merak Mail Server is prone to an input-validation vulnerability because it uses client-supplied data when performing a 'Forgot Password' function. Attackers can exploit...

[RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component

Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in the IceWarp WebMail Server. Attackers that are in control of a user account for the web-based email and groupware components are able to execut...

[RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component

Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in the IceWarp WebMail Server. Attackers that are in control of a user account for the web-based email and groupware components are able to execut...

IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34825/info IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34823/info IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections

source: https://www.securityfocus.com/bid/34820/info IceWarp Merak Mail Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

[RT-SA-2009-001] IceWarp WebMail Server: Cross Site Scripting in Email View

Advisory: IceWarp WebMail Server: Cross Site Scripting in Email View During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to Cross Site Scripting attacks in its email view. This enables attackers to send emails with embedded JavaScript code, for exampl...

IceWarp Merak Mail Server 9.4.1 - cleanHTML() Cross-Site Scripting

IceWarp Merak Mail Server 9.4.1 - cleanHTML Cross-Site Scripting source: https://www.securityfocus.com/bid/34823/info IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this...

Stack overflow

Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method, as possibly demonstrated by a web...

CVE-2009-1516

Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method, as possibly demonstrated by a web...

CVE-2009-1516

Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method, as possibly demonstrated by a web...

IceWarp Merak Mail Server < 9.4.2 'Base64FileEncode()' Stack-Based Buffer Overflow Vulnerability

IceWarp Merak Mail Server is prone to a stack-based buffer overflow vulnerability. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

IceWarp Merak邮件服务器Base64FileEncode()函数栈溢出漏洞

BUGTRAQ ID: 34739 Merak Email Server是一个全面的办公室局域网或Internet通讯邮件解决方案。 Merak邮件服务器的api.dll库没有正确地验证对Base64FileEncode函数所传送的第二个参数，如果远程攻击者向icewarpapiobjectcall函数的最后一个参数提交了超长输入的话，就可以触发栈溢出，导致执行任意代码。 Icewarp Merak Mail Server 9.4.1 Icewarp ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Icewarp Merak Mail Server 9.4.1 Base64FileEncode() BOF PoC

No description provided by source. ?php / Icewarp Merak Mail Server 9.4.1 IceWarpServer.APIObject/api.dll Base64FileEncode stack based buffer overflow poc by Nine:Situations:Group::surfista site: http://retrogod.altervista.org/ api.dll contains a stack based buffer overflow in the second argument...

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode() Buffer Overflow (PoC)

Icewarp Merak Mail Server 9.4.1 - Base64FileEncode Buffer Overflow PoC "cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt...

Icewarp Merak Mail Server 9.4.1 Base64FileEncode() BOF PoC

Exploit for unknown platform in category dos / poc ========================================================== Icewarp Merak Mail Server 9.4.1 Base64FileEncode BOF PoC ========================================================== "cgi-fcgi" die"Launch from the merak php console!"; if...