[SECURITY] Fedora 20 Update: zarafa-7.1.8-1.fc20

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

Ability Mail Server 2013 - Password Reset CSRF from Stored XSS (Web UI)

Exploit for windows platform in category web applications On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a use...

Ability Mail Server 2013 -Persistent Cross-Site Scripting / Cross-Site Request Forgery (Password Reset)

On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a user named, victim, with a password of victim 5. Finish...

CVE-2013-6162

Cross-site scripting XSS vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email...

Cross site scripting

Cross-site scripting XSS vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email...

CVE-2013-6162

Cross-site scripting XSS vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email...

CVE-2013-6162

The CVE-2013-6162 entry affects Code-Crafters Ability Mail Server 3.1.1 (Ability Mail Server 2013). The connected sources detail a Stored XSS vulnerability: an attacker can inject arbitrary HTML/JavaScript via the body of an email, with PoCs showing stored XSS in e‑mail content and, in exploits, ...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

!/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server 2003 SP2 CVE : CVE-2013-6162...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...

Ability Mail Server 2013 (3.1.1) - Stored XSS Vulnerability

Exploit for windows platform in category remote exploits import smtplib emailaddr = 'email protected' email = 'From: %s\n' % emailaddr email += 'To: %s\n' % emailaddr email += 'Subject: XSS\n' email += 'Content-type: text/html\n\n' email += 'alert"XSS"' s = smtplib.SMTP'192.168.58.140', 25...

SEC Consult SA-20130625-0 :: Multiple vulnerabilities in IceWarp Mail Server

SEC Consult Vulnerability Lab Security Advisory 20130625-0 ======================================================================= title: Multiple vulnerabilities in IceWarp Mail Server product: IceWarp Mail Server vulnerable version: =10.4.5 fixed version: 10.4.5-1 impact: Critical homepage:...

Oracle Linux 5 : cyrus-imapd (ELSA-2009-1459)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1459 advisory. - fix more buffer overflows in cyrus sieve CVE-2009-3235 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 5 / 6 : cyrus-imapd (ELSA-2011-0859)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0859 advisory. 2.3.16-6.2 - do not use strict aliasing 2.3.16-6.1 - fix CVE-2011-1926: STARTTLS plaintext command injection vulnerability Tenable has extracted the precedi...

IceWarp Mail Server 10.4.5 XSS / XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities in IceWarp Mail Server product: IceWarp Mail Server vulnerable version: =10.4.5 fixed version: 10.4.5-1 impact: Critical homepage:...

[SECURITY] Fedora 17 Update: clamav-0.97.8-2.fc17

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 19 Update: clamav-0.97.8-2.fc19

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

mx_injection

This plugin will find MX injections. This kind of web application errors are mostly seen in webmail software. The tests are simple, for every injectable parameter a string with special meaning in the mail server is sent, and if in the response I find a mail server error, a vulnerability was found...

Axigen Arbitrary File Read and Delete (CVE-2012-4940)

A directory traversal vulnerability has been reported in AXIGEN Mail Server. The issue is due to the index.hsp script not properly sanitizing user input...

Citadel SMTP RCPT Remote Buffer Overflow - High Confidence (CVE-2008-0394)

The Citadel Server is a mail server product geared towards small and medium size organizations. The product implements POP3, IMAP4, and SMTP services. The SMTP server module is installed and started in a default installation. There exists a buffer overflow vulnerability in Citadel SMTP Server. Th...

OpenSMTPD TLS Blocking Socket Remote DoS

The remote OpenSMTPD mail server has a flaw that could result in further connections to it being blocked when a client holds open a TLS connection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid66586;...