958 matches found
CVE-2007-0955
The NTLMUnPackType3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service application crash via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port 143/tcp, which results in an out-of-bounds read...
CVE-2007-0651: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via 1 e-mail messages and 2 the ID parameter to a right.asp, b Forms/MAI/list.asp, and c Forms/VCF/list.asp in mewebmail/base/default/lang/EN/...
MailEnable Web Mail Client Multiple Vulnerabilities (XSS, CSRF)
The Web Mail Client bundled with the version of MailEnable installed on the remote host reportedly fails to properly sanitize email messages and various script parameters of malicious script code, which can lead to cross-site scripting, cross-site request forgery, and script insertion attacks...
CVE-2007-0652: Undefined Security Weakness
Cross-site request forgery CSRF vulnerability in MailEnable Professional before 2.37 allows remote attackers to modify arbitrary configurations and perform unauthorized actions as arbitrary users via a link or IMG tag...
CVE-2007-0955: Undefined Security Weakness
The NTLMUnPackType3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service application crash via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port 143/tcp, which results in an out-of-bounds read...
MailEnable Professional/Enterprise <= 2.37 Denial of Service Exploit
No description provided by source. !/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target...
[Full-disclosure] MailEnable DoS POC
The POC attached exploits an out of bounds memory read in the NTLM authentication routines of MailEnable Pro/Enterprise. The problem lies in the NTLMUnPackType3 function of MENTLM.dll. This appears to have been silently "patched" somewhere between versions 2.351 and 2.36-7. observe the quotes...
MailEnable Professional/Enterprise 2.35 - Out of Bounds Denial of Service
!/usr/bin/perl maildisable-v5.pl Mail Enable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET, encodebase64$buf."\r\n", 0; sleep$senddelay; $buf = $PAD x 28. "\x00\x01". $PAD x 2...
MailEnable ProfessionalEnterprise 2.35 - Out of Bounds Denial of Service
MailEnable ProfessionalEnterprise 2.35 - Out of Bounds Denial of Service !/usr/bin/perl maildisable-v5.pl Mail Enable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET,...
MailEnable ProfessionalEnterprise 2.37 - Denial of Service
MailEnable ProfessionalEnterprise 2.37 - Denial of Service !/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; i...
MailEnable Professional/Enterprise <= 2.37 Denial of Service Exploit
Exploit for unknown platform in category dos / poc ==================================================================== MailEnable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET,...
MailEnable Professional/Enterprise 2.37 - Denial of Service
!/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my...
MailEnable Professional/Enterprise <= 2.35 Out of Bounds DoS Exploit
Exploit for unknown platform in category dos / poc ==================================================================== MailEnable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET,...
MailEnable Professional/Enterprise <= 2.35 Out of Bounds DoS Exploit
No description provided by source. !/usr/bin/perl maildisable-v5.pl Mail Enable Professional/Enterprise =v2.35 win32 by mu-b - Wed Nov 29 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32 Mail Enable...
[Full-disclosure] Secunia Research: MailEnable Web Mail Client Multiple Vulnerabilities
====================================================================== Secunia Research 14/02/2007 - MailEnable Web Mail Client Multiple Vulnerabilities - ====================================================================== Table of Contents Affected...
CVE-2006-6997
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors. NOTE: due to lack of details, it is not clear...
CVE-2006-6997
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors. NOTE: due to lack of details, it is not clear...
CVE-2006-6997
The CVE-2006-6997 entry concerns an unspecified vulnerability in a cryptographic feature of MailEnable, resulting in weakened authentication security. Affected versions are MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21. The descripti...
CVE-2006-6997: Improper Authentication
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors. NOTE: due to lack of details, it is not clear...
CVE-2006-6964
MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source...