Command injection

The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a...

CVE-2011-1506

The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a...

CVE-2011-1506

Technical details for CVE-2011-1506 are not publicly provided in the supplied connected documents. The available sources describe a plaintext command injection pattern but do not give Kerio Connect/MailServer product/version/root‑cause specifics here. Monitor for updates.

STARTTLS plaintext command injection vulnerability

Overview Some STARTTLS implementations could allow a remote attacker to inject commands during the plaintext phase of the protocol. Description STARTTLS is an extension to plaintext communication protocols that offers a way to upgrade a plaintext connection to an encrypted TLS or SSL connection...

Kerio Control Detection

Kerio Control formerly known as Kerio WinRoute is installed on the remote Windows host. It acts as a software-based firewall. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid51388; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate",...

Kerio Control < 7.1.0 Build 1689 Remote Cache Poisoning

The version of Kerio Control formerly known as Kerio WinRoute installed on the remote host is earlier than 7.1.0 Build 1689. Such versions are reportedly affected by a remote cache poisoning vulnerability. By sending specially crafted HTTP data over a non-HTTP TCP connection, a remote,...

Kerio Control Web Filter Unspecified Issue

Kerio Control is affected by a remote unspecified vulnerability in its Web Filter component. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid50978; scriptversion"1.7"; scriptcvsdate"Date: 2018/11/15 20:50:27"; scriptbugtraqid45105; scriptxrefname:"Secunia",...

Kerio Connect < 7.0.0 Products Administration Console File Disclosure and Corruption Vulnerabilities

According to its banner, the remote host is running a version of Kerio Connect or Kerio MailServer as it was formerly known prior to 7.0.0. Successful exploitation of remote file disclosure and corruption vulnerabilities in the administration console of such versions could allow an attacker to...

Kerio Personal Firewall 2.1.4 - Authentication Packet Overflow (Metasploit)

$Id: kerioauth.rb 9525 2010-06-15 07:18:08Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

Multiple Kerio Products are prone to a file disclosure and corruption vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

Multiple Kerio Products are prone to a file disclosure and corruption vulnerability. An attacker can exploit this vulnerability to gain access to files and corrupt data on a vulnerable computer. This may aid in further attacks. Kerio MailServer up to and including version 6.7.3 as well as Kerio...

Kerio MailServer / Connect < 7.0.1 Administration Console File Disclosure and File Corruption Vulnerability

Binary data 5561.prm...

Kerio Firewall 2.1.4 Authentication Packet Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Kerio Firewa...

Kerio MailServer WebMail 'Integration' Page XSS Vulnerability

The host is running Kerio MailServer and is prone to Cross-Site Scripting vulnerability OpenVAS Vulnerability Test $Id: gbkeriomailserverxssvulnaug09.nasl 4869 2016-12-29 11:01:45Z teissa $ Kerio MailServer WebMail 'Integration' Page XSS Vulnerability Authors: Antu Sanadi Copyright: Copyright c...

Kerio MailServer WebMail 'Integration' Page XSS Vulnerability

Kerio MailServer is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

Cross-site scripting XSS vulnerability in the Integration page in the WebMail component in Kerio MailServer 6.6.0, 6.6.1, 6.6.2, and 6.7.0 allows remote attackers to inject arbitrary web script or HTML via an e-mail message...

CVE-2009-2636

Kerio MailServer WebMail usion page vulnerability CVE-2009-2636 is a cross-site scripting (XSS) flaw in the WebMail integration page. Affects Kerio MailServer 6.6.0, 6.6.1, 6.6.2, and 6.7.0. Exploitation allows an attacker to inject arbitrary web script or HTML via an e-mail message, with impact...

Kerio MailServer < 6.6.2 Patch 3 / 6.7.0 Patch 1 XSS (KSEC-2009-06-08-01)

According to its banner, the remote host is running a version of Kerio MailServer prior to 6.6.2 Patch 3 or 6.7.0 Patch 1. The webmail component of such versions is reportedly affected by a cross-site scripting vulnerability on the Integration page. Successful exploitation of this issue could lea...

Kerio Mail Server Multiple Cross Site Scripting vulnerabilities

Kerio Mail Server is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Kerio Mail Server Multiple Cross Site Scripting vulnerabilities

The host is running Kerio Mail Server and is prone to multiple cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbkeriomailservermultxssvuln.nasl 4869 2016-12-29 11:01:45Z teissa $ Kerio Mail Server Multiple Cross Site Scripting vulnerabilities Authors: Chandan S Copyright:...