CVE-2005-1488

Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 contains multiple cross-site scripting (XSS) vulnerabilities. Remote authenticated users can inject arbitrary web script or HTML through four input paths: (1) E-mail address, Note, or Public Certificate fields to address.html, (2) addressaction....

CVE-2005-1489

CVE-2005-1489 concerns Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2. The description states that remote authenticated users can obtain the server’s full path by making requests to calendar_addevent.html, calendar_event.html, or calendar_task.html. The available data include a CVSS v2 base ...

CVE-2005-1488

Multiple cross-site scripting XSS vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 the E-mail address, Note, or Public Certificate fields to address.html, 2 addressaction.html, 3 the Signature fiel...

CVE-2005-1491

Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allows remote authenticated users to 1 move their home directory via viewaction.html or 2 move arbitrary files via the importfile parameter to importaction.html...

CVE-2005-1490

Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2, when the mailbox.dat file does not exist, allows remote authenticated users to determine if a file exists via the folder parameter to attachment.html...

CVE-2005-1489

Unknown vulnerability in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allows remote authenticated users to obtain the full path of the server via certain requests to 1 calendaraddevent.html, 2 calendarevent.html, or 3 calendartask.html...

CVE-2005-1490

CVE-2005-1490 (Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2) : When the mailbox.dat file does not exist, remote authenticated users can determine whether a file exists by using the folder parameter to attachment.html. The affected components are Merak Mail Server 8.0.3 and Icewarp Web Mail...

CVE-2005-1489

Unknown vulnerability in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allows remote authenticated users to obtain the full path of the server via certain requests to 1 calendaraddevent.html, 2 calendarevent.html, or 3 calendartask.html...

Multiple vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2

ShineShadow Security Report 04052005-05 TITLE: Multiple vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest,...

CVE-2005-0321

MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allows remote authenticated users to gain sensitive information via an HTTP request to 1 calendard.html, 2 calendarm.html, 3 calendarw.html, or 4 calendary.html, which reveal the installation path...

CVE-2005-0322

MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 uses weak encryption in the 1 users.cfg, 2 settings.cfg, 3 users.dat or 4 user.dat files, which allows local users to extract the passwords...

CVE-2004-1669

CVE-2004-1669 describes a cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 when used with IceWarp Web Mail 5.2.7 (and possibly other versions). The issue allows remote attackers to run arbitrary HTML/JavaScript in a victim’s browser by supplying malicious input to (1) the User ...

CVE-2004-1669

Cross-site scripting XSS vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the 1 User name parameter to accountsettings.html or 2 Search string parameter to search.html...

CVE-2004-1672

CVE-2004-1672 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions. A flaw in attachment.html allows remote attackers to view other users’ attachments by crafting an HTTP request that specifies a username and a message ID, enabling partial confidentiality loss (...

CVE-2004-1671

The CVE-2004-1671 entry describes an information disclosure in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability allows remote attackers to gain sensitive information via direct requests to two web pages: accountsettings_add.html and topmenu.html...

CVE-2004-1670

CVE-2004-1670 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability enables directory traversal: an attacker can create arbitrary directories by supplying .. in the user parameter to viewaction.html, and can rename arbitrary files by supplyin...

CVE-2004-1672

attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request...

CVE-2004-1673

The CVE-2004-1673 entry concerns Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The flaw allows remote attackers to create text files with arbitrary content via the accountid parameter in accountsettings_add.html, indicating insufficient input validation in the...

CVE-2005-0320

CVE-2005-0320 concerns multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific parameters: login.html (username), accountsettings_add.html (accountid), and calendar....

CVE-2005-0320

Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to login.html, 2 accountid parameter to accountsettingsadd.html, or the 3 note, 4 title, and 5 location...