CVE-2004-1720

The 1 address.html and possibly 2 calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web log...

Cyrus IMAP mail server multiple bugs

Multiple buffer overflows, memory corruptions...

CVE-2004-1674

viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to 1 delete arbitrary files via the originalfolder parameter or 2 move arbitrary files via the messageid parameter...

CVE-2004-1669

Cross-site scripting XSS vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the 1 User name parameter to accountsettings.html or 2 Search string parameter to search.html...

CVE-2004-1672

CVE-2004-1672 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions. A flaw in attachment.html allows remote attackers to view other users’ attachments by crafting an HTTP request that specifies a username and a message ID, enabling partial confidentiality loss (...

CVE-2004-1671

Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a direct request to 1 accountsettingsadd.html or 2 topmenu.html...

CVE-2004-1673

accountsettingsadd.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create text files with arbitrary content via the accountid parameter...

CVE-2004-1674

The CVE-2004-1674 entry concerns Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability is in viewaction.html, where input parameters originalfolder and messageid enable remote attackers to perform file operations. Specifically, attackers can delete a...

CVE-2004-1670

CVE-2004-1670 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability enables directory traversal: an attacker can create arbitrary directories by supplying .. in the user parameter to viewaction.html, and can rename arbitrary files by supplyin...

CVE-2004-1672

attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request...

CVE-2004-1671

The CVE-2004-1671 entry describes an information disclosure in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability allows remote attackers to gain sensitive information via direct requests to two web pages: accountsettings_add.html and topmenu.html...

CVE-2004-1670

Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to 1 create arbitrary directories via a .. dot dot in the user parameter to viewaction.html or 2 rename arbitrary files via a ....// doubled dot do...

CVE-2004-1673

The CVE-2004-1673 entry concerns Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The flaw allows remote attackers to create text files with arbitrary content via the accountid parameter in accountsettings_add.html, indicating insufficient input validation in the...

CVE-2004-1669

CVE-2004-1669 describes a cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 when used with IceWarp Web Mail 5.2.7 (and possibly other versions). The issue allows remote attackers to run arbitrary HTML/JavaScript in a victim’s browser by supplying malicious input to (1) the User ...

CVE-2005-0367

Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arbitrary files via a .. dot dot in 1 the filename of an e-mail attachment, 2 the msgatt.rec file, 3 and the /msg, /delete, /folderadd, and /folderdelete...

CVE-2005-0367

This entry documents directory-traversal flaws in ArGoSoft Mail Server (notably versions around 1.8.7.3/1.8.7.6) that allow remote authenticated users to read, delete, or upload arbitrary files. The root cause is traversal via .. in multiple vectors: the filename of an email attachment, the _msga...

CVE-2005-0322

CVE-2005-0322 affects MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2. The issue is weak encryption in the configuration and data files (users.cfg, settings.cfg, users.dat, user.dat), which allows local users to extract stored passwords. T...

CVE-2005-0332

Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to 1 upload and possibly execute files outside the directory via the AttachmentsKey parameter to attachment.do, as demonstrated using JSP pages, or 2 delete arbitrary files via the selectfile...

CVE-2005-0320

CVE-2005-0320 concerns multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific parameters: login.html (username), accountsettings_add.html (accountid), and calendar....

CVE-2005-0322

MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 uses weak encryption in the 1 users.cfg, 2 settings.cfg, 3 users.dat or 4 user.dat files, which allows local users to extract the passwords...