CVE-2004-1670

CVE-2004-1670 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability enables directory traversal: an attacker can create arbitrary directories by supplying .. in the user parameter to viewaction.html, and can rename arbitrary files by supplyin...

CVE-2004-1671

The CVE-2004-1671 entry describes an information disclosure in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability allows remote attackers to gain sensitive information via direct requests to two web pages: accountsettings_add.html and topmenu.html...

CVE-2004-1669

CVE-2004-1669 describes a cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 when used with IceWarp Web Mail 5.2.7 (and possibly other versions). The issue allows remote attackers to run arbitrary HTML/JavaScript in a victim’s browser by supplying malicious input to (1) the User ...

CVE-2004-1672

attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request...

CVE-2004-1673

The CVE-2004-1673 entry concerns Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The flaw allows remote attackers to create text files with arbitrary content via the accountid parameter in accountsettings_add.html, indicating insufficient input validation in the...

CVE-2005-0322

CVE-2005-0322 affects MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2. The issue is weak encryption in the configuration and data files (users.cfg, settings.cfg, users.dat, user.dat), which allows local users to extract stored passwords. T...

CVE-2005-0320

Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to login.html, 2 accountid parameter to accountsettingsadd.html, or the 3 note, 4 title, and 5 location...

CVE-2005-0320

CVE-2005-0320 concerns multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific parameters: login.html (username), accountsettings_add.html (accountid), and calendar....

Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holes

ShineShadow Security Report 26012005-03 TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.3.0 : New holes. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secur...

HexView Security Advisory 2601-20-05.03

ShineShadow Security Report 26012005-03 TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.3.0 : New holes. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secur...

IceWarp Web Mail < 5.3.3 Multiple Vulnerabilities (3)

Binary data 2573.prm...

IceWarp Web Mail Multiple Flaws (3)

The remote host is running IceWarp Web Mail - a webmail solution available for the Microsoft Windows platform. The remote version of this software is vulnerable to multiple input validation issues that could allow an attacker to compromise the integrity of the remote host. %NASLMINLEVEL 70300 C...

IceWarp Web Mail 5.3 - login.html Username Cross-Site Scripting

IceWarp Web Mail 5.3 - login.html Username Cross-Site Scripting source: https://www.securityfocus.com/bid/12396/info Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors. Multiple cross-site scripting and HTML...

IceWarp Web Mail 5.3 - accountsettings_add.html?accountid Cross-Site Scripting

IceWarp Web Mail 5.3 - accountsettingsadd.html?accountid Cross-Site Scripting source: https://www.securityfocus.com/bid/12396/info Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors. Multiple cross-site scripting...

IceWarp Web Mail 5.3 - login.html 'Username' Cross-Site Scripting

source: https://www.securityfocus.com/bid/12396/info Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors. Multiple cross-site scripting and HTML injection vulnerabilities affect the vulnerable software. The produc...

CVE-2004-0336

LAN SUITE Web Mail 602Pro allows remote attackers to gain sensitive information via the mail login form, which contains the path to the mail directory...

CVE-2004-0335

LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to 1 index.html, 2 cgi-bin/, or 3 users/...

CVE-2004-0337

Cross-site scripting XSS vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html, followed by a / slash and the desired script. NOTE: the vendor states that this bug could not be reproduced, so this issue may be...

icewarpWebmail528.txt

TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.2.8 : New face of old problems. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secure and 100% virus free mai...

IceWarp Web Mail Multiple Flaws (2)

The remote host is running IceWarp Web Mail - a webmail solution available for the Microsoft Windows platform. The remote version of this software is vulnerable to multiple input validation issues that could allow an attacker to compromise the integrity of the remote host. %NASLMINLEVEL 70300 C...