196 matches found
Cross site request forgery (csrf)
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...
Cross site scripting
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...
Design/Logic Flaw
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...
Privilege escalation
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6288
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6290
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6289
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6291
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6291
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6288
Kaspersky Secure Mail Gateway 1.1.0.379 Web Management Console has multiple CSRF/CONFIG injection flaws described by CORE-2017-0010: CVE-2018-6288 enables admin takeover via missing anti-CSRF tokens; CVE-2018-6289 injects Postfix config to run commands as root; CVE-2018-6290 uses a setuid binary ...
CVE-2018-6290
CVE-2018-6290 is a local privilege escalation in Kaspersky Secure Mail Gateway 1.1.0.379 where a setuid root binary at /opt/kaspersky/klms-appliance/libexec/upgrade/upgrade_launcher can be abused by a kluser to run a malicious Python script, elevating privileges to root. The Core Security advisor...
CVE-2018-6291
Kaspersky Secure Mail Gateway 1.1.0.379 web management console contains multiple vulnerabilities described in CORE-2017-0010, including CVE-2018-6291 (Reflected XSS in importSettings callback) and related CVEs (CVE-2018-6288/6289/6290) enabling CSRF, remote command execution as root via crafted s...
CVE-2018-6288
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6289
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6291
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6290
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...
CVE-2018-6289
Kaspersky Secure Mail Gateway 1.1.0.379 has a Web Management Console vulnerability (CVE-2018-6289) that allows configuration-file injection into /etc/postfix/main.cf, enabling arbitrary commands to execute as root. The Core Security advisory CORE-2017-0010 details that adding a crafted BCC addres...
Kaspersky Secure Mail Gateway 1.1.0.379 CSRF / Code Execution Vulnerabilities
Exploit for multiple platform in category remote exploits Kaspersky Secure Mail Gateway Multiple Vulnerabilities 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory URL:...
Kaspersky Secure Mail Gateway Detection
Detection of Kaspersky Secure Mail Gateway. The script sends a connection request to the server and attempts to detect Kaspersky Secure Mail Gateway and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...
