ArGoSoft Mail Server < 1.8.7.0 Multiple Vulnerabilities

There are multiple flaws in ArGoSoft WebMail interface which may allow an attacker to bypass authentication, inject HTML in the e-mails read by the users and even to read arbitrary files on that server. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a...

CVE-2004-2503

INweb Mail Server 2.40 is affected. The issue allows remote attackers to cause a denial of service (crash) by a large number of connect/disconnect actions to the POP3 and SMTP services. The provided sources do not detail root cause or a patch; exploitation info is not stated. Remediation details ...

CVE-2004-2495

The 1 Webmail, 2 admin, and 3 SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service CPU consumption via a large number of simultaneous connections to the service...

CVE-2004-2521

Mail server in Gattaca Server 2003 1.1.10.0 allows remote attackers to perform a denial of service application crash via a large number of connections to TCP port 1 25 SMTP or 2 110 POP...

CVE-2004-2521

CVE-2004-2521 affects Gattaca Server 2003 (version 1.1.10.0). The vulnerability allows a remote attacker to cause a denial-of-service (application crash) by opening a large number of connections to SMTP (port 25) or POP (port 110). The issue is documented across multiple sources (NVD, CVE list, E...

CVE-2004-2494

Cross-site scripting XSS vulnerability in error in Ability Mail Server 1.18 allows remote attackers to inject arbitrary web script or HTML via the erromsg parameter...

CVE-2004-2503

INweb Mail Server 2.40 allows remote attackers to cause a denial of service crash via a large number of connect/disconnect actions to the 1 POP3 and 2 SMTP services...

CVE-2004-2494: Undefined Security Weakness

Cross-site scripting XSS vulnerability in error in Ability Mail Server 1.18 allows remote attackers to inject arbitrary web script or HTML via the erromsg parameter...

CVE-2004-2503: Undefined Security Weakness

INweb Mail Server 2.40 allows remote attackers to cause a denial of service crash via a large number of connect/disconnect actions to the 1 POP3 and 2 SMTP services...

CVE-2004-2495: Undefined Security Weakness

The 1 Webmail, 2 admin, and 3 SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service CPU consumption via a large number of simultaneous connections to the service...

MerakXSS.txt

ShineShadow Security Report 30092005-06 TITLE: Multiple vulnerabilities in Merak Mail Server 8.2.4r with Icewarp Web Mail 5.5.1. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting- edge Merak Mail Server Instant Antispam and much more, is the fastest,...

CVE-2005-3131

Multiple cross-site scripting XSS vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to blank.html, or the createdataCX parameter to 2 calendard.html, 3...

CVE-2005-3133

Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to 1 delete arbitrary files or directories via a relative path to the id parameter to logout.html or 2 include arbitrary PHP files or other...

CVE-2005-3132

MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to bwlistinc.html, which reveals the path in an error message...

CVE-2005-3132

CVE-2005-3132 affects MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 (and possibly earlier). The vulnerability allows remote attackers to obtain sensitive information by directly requesting bwlist_inc.html, causing an error message that reveals the path. Impact is partial confidentiality di...

CVE-2005-3133

Observation: CVE-2005-3133 describes multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 (and possibly earlier versions). The issues allow remote attackers to: (1) delete arbitrary files or directories via a relative path supplied to the id paramet...

CVE-2005-3133

Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to 1 delete arbitrary files or directories via a relative path to the id parameter to logout.html or 2 include arbitrary PHP files or other...

CVE-2005-3131

Summary (CVE-2005-3131) : Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 (and possibly earlier) allow remote attackers to inject arbitrary web script or HTML. The issues arise via the (1) id parameter to blank.html and (2) createdataCX ...

CVE-2005-3131

Multiple cross-site scripting XSS vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to blank.html, or the createdataCX parameter to 2 calendard.html, 3...

CVE-2005-3132

MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to bwlistinc.html, which reveals the path in an error message...