CVE-2012-2586

CVE-2012-2586 affects Mailtraq 2.17.3.3150 with multiple XSS vulnerabilities. The issue arises from failure to sanitize untrusted input in email content and headers, enabling remote injection of scripts via: (1) subject, (2) body payloads (IFRAME SRC, data: URL in META CONTENT, IMG STYLE CSS expr...

CVE-2012-2586: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with 1 a JavaScript alert function used in conjunction with the fromCharCode method or 2 a SCRIPT element; an e-mail message body...

MailTraq 2.17.3.3150 Cross Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT...

mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT...

MailTraq 2.17.3.3150 Stored XSS

Exploit for php platform in category web applications !/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability...

mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting

mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability...

mailtraq-update.txt

Recently, a vulnerability was discovered by Reed Arvin in the Mailtraq 2.6.1.1677 administration console. The vendor provided solution does not fully mitigate the privilege escalation vulnerability. You will find the original vulnerability advisory and the updated work around exploit information...

Privilege escalation in Mailtraq Version 2.6.1.1677.

Summary: A privilege escalation flaw exists in Mailtraq Version 2.6.1.1677 http://www.mailtraq.com/. Details: A privilege escalation technique can be used to gain SYSTEM level access while using the Mailtraq administration console. Vulnerable Versions: Mailtraq Version 2.6.1.1677. Solution: The...

Mailtraq privilege escalation

It's possible to execute external application with LocalSystem account...

mailtraq.txt

Summary: A privilege escalation flaw exists in Mailtraq Version 2.6.1.1677 http://www.mailtraq.com/. Details: A privilege escalation technique can be used to gain SYSTEM level access while using the Mailtraq administration console. Vulnerable Versions: Mailtraq Version 2.6.1.1677. Solution: The...

Mailtraq 2.x - Administration Console Privilege Escalation

source: https://www.securityfocus.com/bid/11708/info Mailtraq allows a user to activate the Mailtraq administration console software by easily launching the software from an icon in the Windows system tray. It is reported that a local user may exploit the administration console interface to...

Mailtraq 2.x - Administration Console Privilege Escalation

Mailtraq 2.x - Administration Console Privilege Escalation source: https://www.securityfocus.com/bid/11708/info Mailtraq allows a user to activate the Mailtraq administration console software by easily launching the software from an icon in the Windows system tray. It is reported that a local use...

Multiple Vulnerabilities Found in Mailtraq (DoS, Password Decryption, Directory Traversal)

The original advisory is available from: http://www.securiteam.com/windowsntfocus/5HP0G1FAAC.html Summary: --------- Mailtraq is a "comprehensive e-mail SMTP/POP3 and proxy server, with a powerful mailing list server". The product suffered from multiple vulnerabilities that range from access to...

Multiple mailtraq bugs

Directory traversal, passwords decryption, format string bugs, crossite scripting, etc...

5HP0G1FAAC.txt

Title 9/6/2003 Multiple Vulnerabilities Found in Mailtraq DoS, Password Decryption, Directory Traversal Summary Mailtraq is a "comprehensive e-mail SMTP/POP3 and proxy server, with a powerful mailing list server". The product suffered from multiple vulnerabilities that range from access to files...

Mailtraq 2.1.0.1302 - User Password Encoding

Mailtraq 2.1.0.1302 - User Password Encoding source: https://www.securityfocus.com/bid/7923/info It has been reported that Mailtraq does not securely store passwords. Because of this, an attacker may have an increased chance at gaining access to clear text passwords. !/usr/bin/perl $Password =...

Mailtraq 2.1.0.1302 - User Password Encoding

source: https://www.securityfocus.com/bid/7923/info It has been reported that Mailtraq does not securely store passwords. Because of this, an attacker may have an increased chance at gaining access to clear text passwords. !/usr/bin/perl $Password = $ARGV0; print "Passwords should be something...

Mailtraq 2.1.0.1302 - Remote Format String SMTP Resource Consumption

Mailtraq 2.1.0.1302 - Remote Format String SMTP Resource Consumption source: https://www.securityfocus.com/bid/7926/info It has been reported that Mailtraq does not reliably handle format strings in some SMTP protocol fields. This may cause a system to become unstable and crash, allowing a remote...

Mailtraq 2.1.0.1302 - Remote Format String SMTP Resource Consumption

source: https://www.securityfocus.com/bid/7926/info It has been reported that Mailtraq does not reliably handle format strings in some SMTP protocol fields. This may cause a system to become unstable and crash, allowing a remote attacker to deny service to the system. @@%s%p%n %s%p%n...

Mailtraq 2.2 - Webmail Utility Full Path Disclosure

Mailtraq 2.2 - Webmail Utility Full Path Disclosure source: https://www.securityfocus.com/bid/7815/info A vulnerability has been reported for Mailtraq that may result in the disclosure of path information. The vulnerability exists due to insufficient sanitization of HTTP requests. Specifically, a...