Cross site scripting

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

CVE-2020-23776

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

CVE-2020-23776

CVE-2020-23776 is an SSRF vulnerability affecting Winmail 6.5 in app.php (parameter key) when HTTPS is enabled. The issue allows an attacker to induce the server to make HTTP requests to a target URL by manipulating the HOST header in requests. Documented in multiple feeds (NVD/Red Hat/CVE lists)...

CVE-2020-23774

The CVE-2020-23774 entry concerns a reflected XSS in Winmail 6.5, specifically in tohtml/convert.php. The underlying issue is the ability to cause JavaScript execution via user-controlled input reflected in the response. Evidence from connected records confirms the affected software/component and...

CVE-2020-23774

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

CVE-2020-23774: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

PT-2021-10948

Name of the Vulnerable Software and Affected Versions: Winmail version 6.5 Description: A Server-Side Request Forgery SSRF issue exists in the app.php file, specifically in the key parameter when HTTPS is enabled. This allows an attacker to manipulate the server into sending a request to a specif...

Winmail Cross-Site Scripting Vulnerability

Winmail is a server-side application used to provide mail services by Suzhou Huazhao Technology Winmail Company in China. A cross-site scripting vulnerability exists in Winmail version 6.5. An attacker can exploit this vulnerability to steal sensitive information...

PT-2021-10947

Name of the Vulnerable Software and Affected Versions: Winmail version 6.5 Description: A reflected XSS issue exists in the tohtml/convert.php file, allowing JavaScript code to be executed. Recommendations: For Winmail version 6.5, at the moment, there is no information about a newer version that...

CVE-2020-23776: Server-Side Request Forgery (SSRF)

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

Winmail Code Issue Vulnerability

Winmail is a server-side application used to provide email services by Suzhou Huazhao Technology Winmail Company in China. A code issue vulnerability exists in Winmail version 6.5. An attacker can exploit this vulnerability to cause the server to send requests to a specific URL...

UBUNTU-CVE-2019-18849

In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup...

PT-2019-15699 · Tnef +2 · Tnef +2

Name of the Vulnerable Software and Affected Versions: tnef versions prior to 1.4.18 Description: The issue allows an attacker to potentially write to the victim's .ssh/authorized keys file via a crafted winmail.dat application/ms-tnef attachment in an email message. This is due to a heap-based...

Winmail Server < 6.3 Directory Traversal Vulnerability

Winmail Server allows remote code execution RCE by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might...

Winmail Server Detection (HTTP)

Detection of Winmail Server Webmail. The script sends a connection HTTP based request to the server and attempts to detect Winmail Server Webmail and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

AMAX Winmail Server Remote Code Execution Vulnerability

AMAX Winmail Server is a set of mail server software from AMAX Group. The software supports SMTP, POP3, WEBMAIL, anti-virus, SMTP authentication and remote control and other functions. A security vulnerability exists in AMAX Winmail Server 6.2 and earlier versions. A remote attacker can exploit t...

CVE-2018-5700

Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder...

CVE-2018-5700

Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder...

Directory traversal

Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder...

CVE-2018-5700

Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder...