MailEnable cross-site scripting vulnerability (CNVD-2019-27601)

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in MailEnable versions prior to 8.60. An attacker can exploit this vulnerability to execute JavaScript code by sending an email...

MailEnable Cross-Site Scripting Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in the mail settings in MailEnable versions prior to 8.60. The vulnerability can be exploited by an attacker to read local files or scan the internal network by sending the...

MailEnable Trust Management Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A security vulnerability exists in MailEnable versions prior to 8.60. The vulnerability stems from AUTH.TAB incorrectly handling the '%0A' sequence after receiving a password change request. An attacker can exploit the...

MailEnable Path Traversal Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A directory traversal vulnerability exists in MailEnable versions prior to 8.60, which stems from the program incorrectly handling '/... /' and '/... /' sequences. An attacker could exploit this vulnerability to read...

Directory traversal

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

Cross site request forgery (csrf)

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

Design/Logic Flaw

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

Design/Logic Flaw

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

CVE-2015-9277

MailEnable before 8.60 is affected by a directory traversal due to mishandling of /../ and /.. / sequences, allowing an attacker to read other users’ messages and potentially upload and delete files. Affected product: MailEnable (before 8.60). Root cause: improper normalization of path traversal ...

CVE-2015-9279

CVE-2015-9279 affects MailEnable prior to version 8.60. The issue is a Stored XSS via malformed HTML in email bodies where a tag like "" character, enabling script execution. Affected component is MailEnable’s mail server rendering/processing of email content (stored XSS). Impact described in sou...

CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

CVE-2015-9280

MailEnable before 8.60 is vulnerable to an XML External Entity (XXE) attack via an XML document in the request.aspx Options parameter, per CVE-2015-9280. The vulnerability affects MailEnable's handling of XML in that parameter and can lead to high-severity impact, with CVSSv3.1 base score 10.0 (C...

CVE-2015-9278

Summary: MailEnable before 8.60 is vulnerable to privilege escalation due to incorrect handling of the %0A sequence in AUTH.TAB after a password-change request, enabling an attacker to create or modify admin-like accounts. Affected product/versions: MailEnable prior to 8.60. Root cause: mishandli...

CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...