CVE-2021-32233

SmarterTools SmarterMail before Build 7776 allows XSS...

CVE-2021-32233

SmarterTools SmarterMail before Build 7776 allows XSS...

Cross site scripting

SmarterTools SmarterMail before Build 7776 allows XSS...

CVE-2021-32233

SmarterTools SmarterMail before Build 7776 allows XSS...

CVE-2021-32233

CVE-2021-32233 affects SmarterTools SmarterMail prior to Build 7776, where a lack of proper validation in the web application enables cross-site scripting (XSS). Exploitation details are not provided in the documents, but the vulnerability is described as a client-side code execution risk due to ...

Exploit for Deserialization of Untrusted Data in Smartertools Smartermail

CVE-2019-7214 Remote Code Execution in .NET deseria...

CVE-2019-7213

SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside th...

CVE-2019-7214

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...

CVE-2019-7214

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...

CVE-2019-7212

SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists...

CVE-2019-7211

SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment...

Cross site scripting

SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment...

Deserialization of untrusted data

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...

Directory traversal

SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside th...

CVE-2019-7212

SmarterTools SmarterMail 16.x before build 6985 is affected by a hardcoded secret key vulnerability that enables an unauthenticated actor to access other users’ emails and file attachments and to interact with mailing lists. Root cause: hardcoded credentials in the product. Affected component: Sm...

CVE-2019-7212

SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists...

CVE-2019-7211

SmarterTools SmarterMail 16.x before build 6995 contains a stored XSS vulnerability. The issue allows JavaScript execution within the application when a user opens a malicious email or views a malicious file attachment. The affected component is the email/viewing functionality in SmarterMail 16.x...

CVE-2019-7214

CVE-2019-7214 is a deserialization vulnerability in SmarterTools SmarterMail prior to build 6985. The issue arises from deserializing untrusted data via .NET remoting endpoints exposed on port 17001 (notably /Servers, /Mail, /Spool), allowing an unauthenticated attacker to execute arbitrary comma...

CVE-2019-7214

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...

Cross site scripting

SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using...