CVE-2018-7705

SecurEnvoy SecurMail vulnerability CVE-2018-7705 is a directory traversal flaw in secupload2/upload.aspx that allows remote authenticated users to read emails to arbitrary recipients. Affected products are SecurEnvoy SecurMail versions before 9.2.501; the issue is fixed in 9.2.501 or newer. Impac...

CVE-2018-7706

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

CVE-2018-7702

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization...

CVE-2018-7701

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2018-7704

CVE-2018-7704 affects SecurEnvoy SecurMail prior to 9.2.501. The vulnerability allows remote authenticated users to read arbitrary email messages via the option1 parameter in a reply action to secmail/getmessage.exe, exposing confidential data. Root cause described across sources is an insecure h...

CVE-2018-7707

Affected software : SecurEnvoy SecurMail prior to 9.2.501. Vulnerability : Cross-site scripting (XSS) via an HTML-formatted e-mail message. Root cause / vector : not explicitly detailed beyond the XSS in HTML-format emails; multiple sources attribute vulnerability to improper handling of HTML ema...

CVE-2018-7707

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...

CVE-2018-7701

CVE-2018-7701 covers CSRF vulnerabilities in SecurEnvoy SecurMail

CVE-2018-7706

CVE-2018-7706 affects SecurEnvoy SecurMail prior to 9.2.501. A directory-traversal flaw in the attachment action to secmail/getmessage.exe can be exploited by remote authenticated users to read arbitrary emails via the ".." sequence in the option2 parameter. The condition is tied to a pre-9.2.501...

CVE-2018-7705

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

CVE-2018-7703

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe...

CVE-2018-7704

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7702

CVE-2018-7702 affects SecurEnvoy SecurMail prior to 9.2.501. The flaw allows remote attackers to spoof transmission of arbitrary emails, resend messages to arbitrary recipients, or modify message bodies/attachments by leveraging missing authentication and authorization. The root cause is insuffic...

CVE-2018-7705: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

CVE-2018-7707: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...

CVE-2018-7704: Exposure of Sensitive Information to an Unauthorized Actor

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7706: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

CVE-2018-7703: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe...

CVE-2018-7702: Missing Authorization

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization...

CVE-2018-7701: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...