CVE-2018-6290

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...

Design/Logic Flaw

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

Cross site request forgery (csrf)

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6289

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6290

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6290

CVE-2018-6290 is a local privilege escalation in Kaspersky Secure Mail Gateway 1.1.0.379 where a setuid root binary at /opt/kaspersky/klms-appliance/libexec/upgrade/upgrade_launcher can be abused by a kluser to run a malicious Python script, elevating privileges to root. The Core Security advisor...

CVE-2018-6288

Kaspersky Secure Mail Gateway 1.1.0.379 Web Management Console has multiple CSRF/CONFIG injection flaws described by CORE-2017-0010: CVE-2018-6288 enables admin takeover via missing anti-CSRF tokens; CVE-2018-6289 injects Postfix config to run commands as root; CVE-2018-6290 uses a setuid binary ...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

Kaspersky Secure Mail Gateway 1.1.0.379 web management console contains multiple vulnerabilities described in CORE-2017-0010, including CVE-2018-6291 (Reflected XSS in importSettings callback) and related CVEs (CVE-2018-6288/6289/6290) enabling CSRF, remote command execution as root via crafted s...

CVE-2018-6289

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6289

Kaspersky Secure Mail Gateway 1.1.0.379 has a Web Management Console vulnerability (CVE-2018-6289) that allows configuration-file injection into /etc/postfix/main.cf, enabling arbitrary commands to execute as root. The Core Security advisory CORE-2017-0010 details that adding a crafted BCC addres...

Kaspersky Secure Mail Gateway 1.1.0.379 CSRF / Code Execution Vulnerabilities

Exploit for multiple platform in category remote exploits Kaspersky Secure Mail Gateway Multiple Vulnerabilities 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory URL:...

Kaspersky Secure Mail Gateway Multiple Vulnerabilities

Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL: http://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted:...

Kaspersky Secure Mail Gateway 1.1.0.379 CSRF / Code Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Kaspersky Secure Mail Gateway Multiple Vulnerabilities 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL:...

Kaspersky Secure Mail Gateway Detection

Detection of Kaspersky Secure Mail Gateway. The script sends a connection request to the server and attempts to detect Kaspersky Secure Mail Gateway and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Kaspersky Secure Mail Gateway Multiple Vulnerabilities

Advisory ID Internal CORE-2017-0010 1. Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted: Kaspersky Lab Release mode: Coordinated release 2. Vulnerability...

Proxmox Mail Gateway Open Redirect Vulnerability

Proxmox Mail Gateway is an e-mail gateway product from Proxmox Server Solutions, Austria. The product protects e-mail from virus, phishing and Trojan horse threats. An open redirection vulnerability exists in versions prior to Proxmox Mail Gateway hotfix 4.0-8-097d26a9. A remote attacker can...