CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Kaspersky Secure Mail Gateway 1.1.0.379 Web Management Console has multiple CSRF/CONFIG injection flaws described by CORE-2017-0010: CVE-2018-6288 enables admin takeover via missing anti-CSRF tokens; CVE-2018-6289 injects Postfix config to run commands as root; CVE-2018-6290 uses a setuid binary ...

CVE-2018-6290

CVE-2018-6290 is a local privilege escalation in Kaspersky Secure Mail Gateway 1.1.0.379 where a setuid root binary at /opt/kaspersky/klms-appliance/libexec/upgrade/upgrade_launcher can be abused by a kluser to run a malicious Python script, elevating privileges to root. The Core Security advisor...

CVE-2018-6289

Kaspersky Secure Mail Gateway 1.1.0.379 has a Web Management Console vulnerability (CVE-2018-6289) that allows configuration-file injection into /etc/postfix/main.cf, enabling arbitrary commands to execute as root. The Core Security advisory CORE-2017-0010 details that adding a crafted BCC addres...

CVE-2018-6290: Undefined Security Weakness

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...

Kaspersky Secure Mail Gateway 1.1.0.379 CSRF / Code Execution Vulnerabilities

Exploit for multiple platform in category remote exploits Kaspersky Secure Mail Gateway Multiple Vulnerabilities 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory URL:...

Kaspersky Secure Mail Gateway 1.1.0.379 CSRF / Code Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Kaspersky Secure Mail Gateway Multiple Vulnerabilities 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL:...

CVE-2018-6288: Cross-Site Request Forgery (CSRF)

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

Kaspersky Secure Mail Gateway Multiple Vulnerabilities

Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL: http://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted:...

CVE-2018-6291: Improper Neutralization of Input During Web Page Generation

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6289: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

Kaspersky Secure Mail Gateway Detection

Detection of Kaspersky Secure Mail Gateway. The script sends a connection request to the server and attempts to detect Kaspersky Secure Mail Gateway and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

PT-2018-17452

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue is related to a Cross-Site Scripting XSS problem in the WebConsole of Kaspersky Secure Mail Gateway. This allows for malicious scripts to be executed in the context of the user's...

Kaspersky Secure Mail Gateway Multiple Vulnerabilities

Advisory ID Internal CORE-2017-0010 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted: Kaspersky Lab Release mode: Coordinated release 2. Vulnerability...

PT-2018-17450

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue is related to configuration file injection, which can lead to code execution as root. Recommendations For Kaspersky Secure Mail Gateway version 1.1, update to a version that fixes...

PT-2018-17451

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue concerns a Local Privilege Escalation in Kaspersky Secure Mail Gateway, allowing for potential elevation of privileges. Recommendations For Kaspersky Secure Mail Gateway version...

PT-2017-3403

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue is related to a lack of CSRF token in web forms, insufficient protection of the web page structure, and inadequate output encoding, which can allow a remote attacker to perform a...

Proxmox Mail Gateway Cross-Site Scripting Vulnerability

Proxmox Mail Gateway is an e-mail gateway product from Proxmox Server Solutions, Austria. The product protects e-mail from virus, phishing and Trojan horse threats. A cross-site scripting vulnerability exists in versions prior to Proxmox Mail Gateway hotfix 4.0-8-097d26a9. A remote attacker can...

Proxmox Mail Gateway Open Redirect Vulnerability

Proxmox Mail Gateway is an e-mail gateway product from Proxmox Server Solutions, Austria. The product protects e-mail from virus, phishing and Trojan horse threats. An open redirection vulnerability exists in versions prior to Proxmox Mail Gateway hotfix 4.0-8-097d26a9. A remote attacker can...

CVE-2015-9057

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters, related to /users/index.htm, /quarantine/spam/manage.htm, /quarantine/spam/whitelist.htm,...