CVE-2006-0930

Summary: CVE-2006-0930 describes a directory traversal vulnerability in Webmail of ArGoSoft Mail Server Pro 1.8. Affected component: Webmail/UIDL handling. Root cause: improper handling of the UIDL parameter allowing directory traversal via “..” sequences, enabling a remote authenticated user to ...

Mail Transport System Professional--Open Relay Hole

What: Mail Transport System Professional is a RFC compliant mail server for Windows. Who: http://www.mtsprofessional.com/ Problem: Open relay hole when forwarding all outgoing mail through an ISP. When configured to forward all outgoing mail through an ISP MTS Pro will accept and forward all...

Multiple ArGoSoft Mail Server Pro security vulnerabilities

Information leak with POP3 DUMP command, directory traversal with IMAP RENAME command, directory traversal and crossite scripting with Web interface...

ArGoSoft Mail Server Pro Webmail viewheaders Multiple Field XSS

The remote host is running ArGoSoft Mail Server Pro, a messaging system for Windows. According to its banner, the webmail server bundled with the version of ArGoSoft Mail Server Pro installed on the remote host fails to properly filter message headers before displaying them as part of a message t...

Secunia Research: ArGoSoft Mail Server Pro viewheaders Script Insertion

====================================================================== Secunia Research 27/02/2006 - ArGoSoft Mail Server Pro viewheaders Script Insertion - ====================================================================== Table of Contents Affected...

NSAG-201-24.02.2006.txt

Advisory: NSAG-¹201-24.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: ArGoSoft Mail Server Pro 1.8 POP Site of manufacturer: www.argosoft.com The status: 19/11/2005 - Publication is postponed...

NSAG-200-24.02.2006.txt

Advisory: NSAG-¹200-24.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: ArGoSoft Mail Server Pro 1.8 IMAP Site of manufacturer: www.argosoft.com The status: 19/11/2005 - Publication is postponed...

ArGoSoft Mail Server _DUMP Command System Information Disclosure

The remote host is running ArGoSoft Mail Server, a messaging system for Windows. An unauthenticated attacker can gain information about the installed application as well as the remote host itself by sending the 'DUMP' command to the POP3 server. C Tenable Network Security, Inc. include"compat.inc...

ArGoSoft Mail Server < 1.8.8.6 '_DUMP' Information Disclosure

Binary data 3447.prm...

NSA Group Security Advisory NSAG-№198-23.02.2006 Vulnerability ArGoSoft Mail Server Pro

Advisory: NSAG-№201-24.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: ArGoSoft Mail Server Pro 1.8 POP Site of manufacturer: www.argosoft.com The status: 19/11/2005 - Publication is postponed...

NSA Group Security Advisory NSAG-№200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAP

Advisory: NSAG-№200-24.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: ArGoSoft Mail Server Pro 1.8 IMAP Site of manufacturer: www.argosoft.com The status: 19/11/2005 - Publication is postponed...

Design/Logic Flaw

The VisNetic AntiVirus Plug-in DKAVUpSch.exe for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges...

CVE-2006-0812

The CVE-2006-0812 vulnerability affects VisNetic AntiVirus Plug-in for MailServer (DKAVUpSch.exe) versions 4.6.0.4 and 4.6.1.1 (and possibly earlier than 4.6.1.2). The root cause is that the plug-in does not drop privileges before executing other programs, enabling a local attacker with access to...

AWStats configdir parameter command execution

Added: 02/14/2006 CVE: CVE-2005-0116 BID: 12298 OSVDB: 13002 Background AWStats is a web application for showing web, FTP, and mail server statistics. Problem Insufficient validation of the configdir parameter before being used in a PERL open call leads to remote command execution. Resolution...

neomailXSS.txt

Title: Neomail Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk Discovered: 24 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Webmail Perl Client Vendor: neomail / www.neocodesolutions.com Vulnerability: Cross Site Scripting / Cookie-The...

Mercury Mail Transport System Phonebook service buffer overflow

Added: 02/02/2006 CVE: CVE-2005-4411 BID: 16396 OSVDB: 22103 Background Mercury Mail Transport System is a free mail server for Windows and Netware platforms. It includes a Phone Book service which runs on port 105/TCP. Problem A buffer overflow vulnerability in the Phone Book service allows remo...

Buffer overflow

Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the 1 AUTH PLAIN or 2 AUTH LOGIN SMTP commands, which is not properly handled by a EPSTRS.EXE or b SPA-RS.EXE; 3 a long username in the APOP...

CVE-2006-0447

Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the 1 AUTH PLAIN or 2 AUTH LOGIN SMTP commands, which is not properly handled by a EPSTRS.EXE or b SPA-RS.EXE; 3 a long username in the APOP...

CVE-2006-0447

CVE-2006-0447 involves multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00. The vulnerability allows remote code execution when an attacker supplies a long username in several protocols. Specifically, issues arise in the AUTH PLAIN and AUTH LOGIN SMTP commands (han...

CVE-2006-0447

Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the 1 AUTH PLAIN or 2 AUTH LOGIN SMTP commands, which is not properly handled by a EPSTRS.EXE or b SPA-RS.EXE; 3 a long username in the APOP...