18270 matches found
CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...
CVE-2025-40630
IceWarp Mail Server ≤11.4.0 suffers an open redirect vulnerability. The issue is triggered by crafting malicious URLs that redirect users to arbitrary external domains (examples show vulnerable URL formats). Root cause is improper handling of target URLs leading to redirects. Affected product/ver...
CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...
SUSE CVE-2025-3932
It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web...
IceWarp Mail Server security vulnerabilities
IceWarp Mail Server is a mail server product from the Czech company IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A security vulnerability exists in IceWarp Mail Server version 11.4.0, which originates from HTTP host header injection and cou...
IceWarp Mail Server Cross-Site Script Vulnerability
IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in IceWarp Mail Server, which stems from the application's lack of effectiv...
CommuniGate Pro Path Traversal Unauthorized Access
The vulnerability of the CommuniGate Pro mail server is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by increasing privileges...
CommuniGate Pro Zero Pointer Disclosure
The vulnerability of the CommuniGate Pro mail server is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...
PT-2025-21633 · Icewarp · Icewarp Mail Server
Name of the Vulnerable Software and Affected Versions: IceWarp Mail Server version 11.4.0 Description: The issue is an open redirection vulnerability that allows an attacker to redirect a user to any domain by sending a malicious URL to the victim. For example, an attacker could use a URL like...
CVE-2025-40632: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered...
IceWarp Mail Server has a vulnerability related to input validation errors.
IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. An input validation error vulnerability exists in IceWarp Mail Server, which can be exploited to cause users to be...
CVE-2025-40631: Improper Neutralization of HTTP Headers for Scripting Syntax
HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...
CVE-2025-40630: URL Redirection to Untrusted Site
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com// /%2e%2e” https://icewarp.domain.com///%2e%2e” . This...
PT-2025-21635 · Icewarp · Icewarp Mail Server
Name of the Vulnerable Software and Affected Versions: Icewarp Mail Server version 11.4.0 Description: The issue is related to cross-site scripting XSS that allows an attacker to modify the lastLogin cookie with malicious JavaScript code. This code will be executed when the page is rendered...
PT-2025-21634 · Icewarp · Icewarp Mail Server
Name of the Vulnerable Software and Affected Versions: Icwarp Mail Server version 11.4.0 Description: The issue allows for HTTP host header injection, enabling the execution of arbitrary JavaScript code on page load when a user interacts with a malicious link. This is achieved by modifying the Ho...
CommuniGate Pro Code Execution
The vulnerability of the CommuniGate Pro mail server is related to a countable loss of significance. Exploiting this vulnerability can allow an attacker to execute arbitrary code and cause service failures...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
Malware in @hisdk/mail-mac
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2025-29689
A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java...
