CVE-2025-40631 HTTP host header injection vulnerability in IceWarp Mail Server

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631

CVE-2025-40631 describes an HTTP Host header injection affecting IceWarp Mail Server, version 11.4.0. By modifying the Host header and delivering a payload, arbitrary JavaScript can be executed on the loaded page when a user interacts with a malicious link (redirect). The vulnerability is tied to...

CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...

CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...

CVE-2025-40630

IceWarp Mail Server ≤11.4.0 suffers an open redirect vulnerability. The issue is triggered by crafting malicious URLs that redirect users to arbitrary external domains (examples show vulnerable URL formats). Root cause is improper handling of target URLs leading to redirects. Affected product/ver...

SUSE CVE-2025-3932

It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web...

IceWarp Mail Server 输入验证错误漏洞

IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. An input validation error vulnerability exists in IceWarp Mail Server, which can be exploited to cause users to be...

PT-2025-21635 · Icewarp · Icewarp Mail Server

Name of the Vulnerable Software and Affected Versions: Icewarp Mail Server version 11.4.0 Description: The issue is related to cross-site scripting XSS that allows an attacker to modify the lastLogin cookie with malicious JavaScript code. This code will be executed when the page is rendered...

PT-2025-21634 · Icewarp · Icewarp Mail Server

Name of the Vulnerable Software and Affected Versions: Icwarp Mail Server version 11.4.0 Description: The issue allows for HTTP host header injection, enabling the execution of arbitrary JavaScript code on page load when a user interacts with a malicious link. This is achieved by modifying the Ho...

IceWarp Mail Server 安全漏洞

IceWarp Mail Server is a mail server product from the Czech company IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A security vulnerability exists in IceWarp Mail Server version 11.4.0, which originates from HTTP host header injection and cou...

The vulnerability of the CommuniGate Pro mail server, related to a countable loss of significance, allows a hacker to execute arbitrary code and trigger a service failure.

The vulnerability of the CommuniGate Pro mail server is related to a countable loss of significance. Exploiting this vulnerability can allow an attacker to execute arbitrary code and cause service failures...

The vulnerability of the CommuniGate Pro mail server, related to the swapping of the zero pointer, allows a hacker to disclose protected information.

The vulnerability of the CommuniGate Pro mail server is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the CommuniGate Pro mail server, related to errors in processing the relative path to the directory, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the CommuniGate Pro mail server is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by increasing privileges...

PT-2025-21633 · Icewarp · Icewarp Mail Server

Name of the Vulnerable Software and Affected Versions: IceWarp Mail Server version 11.4.0 Description: The issue is an open redirection vulnerability that allows an attacker to redirect a user to any domain by sending a malicious URL to the victim. For example, an attacker could use a URL like...

IceWarp Mail Server 跨站脚本漏洞

IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in IceWarp Mail Server, which stems from the application's lack of effectiv...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2025-29689

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java...

CVE-2025-46610

ARTEC EMA Mail 6.92 allows CSRF...

CVE-2025-46611

Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the day-to-day operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned input of the parameter password in t...