MailEnable 路径遍历漏洞

MailEnable is a Windows-based commercial e-mail server from MailEnable Australia. A security vulnerability exists in MailEnable versions 10.41, 9.84, and 8.65 and earlier. An attacker could exploit the vulnerability to store arbitrary code on a file and execute arbitrary commands...

MailEnable vulnerability warning CVE-2019-12923~CVE-2019-12927-the vulnerability warning-the black bar safety net

Recently, the mail server MailEnable broke a set of vulnerabilities, the first time for tracking and analysis of early warning. The study found that, using the set of vulnerabilities that an attacker can achieve the user data CRUD, the file is read and a portion of the override operation...

MailEnable Enterprise Premium Path Traversal Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A path traversal vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability stems from a failure of a network system or product to properly filter special elements in the...

MailEnable Enterprise Premium Cross-Site Request Forgery Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site request forgery vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability stems from a WEB application that does not adequately validate that a request is...

MailEnable Enterprise Premium Cross-Site Scripting Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

MailEnable Enterprise Premium Code Issue Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A code issue vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability arises from an improperly designed or implemented code development process for a network system or...

CVE-2019-12925

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN...

CVE-2019-12925

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN...

CVE-2019-12926

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas...

CVE-2019-12927

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

CVE-2019-12926

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas...

CVE-2019-12927

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

Cross site scripting

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

Directory traversal

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN...

Improper access control

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

CVE-2019-12923

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

CVE-2019-12923

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

Xxe

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...