Design/Logic Flaw

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs...

CVE-2022-31245

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs...

CVE-2022-31245

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs...

CVE-2022-31245

CVE-2022-31245 affects mailcow series prior to 2022-05d. A remote authenticated user can inject OS commands and escalate to domain admin by abusing the Sync Jobs feature with crafted parameters (notably via --debug and either ---PIPEMESS/--PIPEMESS in imapsync). Exploitation and PoCs are describe...

Exploit for OS Command Injection in Mailcow Mailcow\:_Dockerized

Mailcow CVE-2022-31245 CVE-2022-31245: RCE and Domain Admin pr...

mailcow 操作系统命令注入漏洞

mailcow is a mail server suite. A security vulnerability exists in versions prior to mailcow 2022-05d, which can be exploited by a remote, authenticated attacker to inject operating system commands and elevate privileges to domain administrator...

Mailcow Cross-Site Request Forgery Vulnerability (CNVD-2017-10371)

Mailcow is a mail server suite that provides a modern web UI interface for user and service management. A cross-site request forgery vulnerability exists in Mailcow. The vulnerability stems from the "admin.php" page not adding authentication such as token or CAPTCHA, which can be exploited by an...

Mailcow 0.14 - Cross-Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI...

Mailcow 0.14 - Cross-Site Request Forgery

Mailcow 0.14 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Produc...

Mailcow 0.14 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI allows administrative work on your mail server instance as well as separated domain administrator and...

CVE-2017-8928

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF...

CVE-2017-8928

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF...

Cross site request forgery (csrf)

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF...

CVE-2017-8928

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF...

CVE-2017-8928

CVE-2017-8928 affects Mailcow 0.14 (as used in mailcow: dockerized and related products). The security issue is Cross-Site Request Forgery (CSRF) in the admin UI, enabling an authenticated user to trigger privileged actions via a malicious page. Documented impact includes: reset admin password, a...

MailCow 0.14 Cross Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI...