Cross site scripting

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

Directory traversal

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN...

Improper access control

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

CVE-2019-12923

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

CVE-2019-12923

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

Xxe

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

Cross site request forgery (csrf)

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

CVE-2019-12927

MailEnable Enterprise Premium 10.23 is affected by stored and reflected XSS due to session cookie not being HttpOnly, enabling possible session hijack when a user opens a malicious email. Affected version: 10.23; fixes are available in 10.25 and later. Remediation: upgrade to the security patch (...

CVE-2019-12927

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

CVE-2019-12926

CVE-2019-12926 affects MailEnable Enterprise Premium (notably version 10.23; fixes noted for 10.24, with 10.25 as the recommended upgrade). The issue is improper access control: the product did not consistently enforce permission checks, allowing authenticated users to perform actions or reach ar...

CVE-2019-12926

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas...

CVE-2019-12925

MailEnable Enterprise Premium 10.23 is affected by a directory traversal vulnerability (CVE-2019-12925). Authenticated users could access folders owned by the IIS user to add, remove, or read files, potentially exposing other users’ credentials and emails. The issue is tied to the product’s path ...

CVE-2019-12925

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN...

CVE-2019-12924

Affected product: MailEnable Enterprise Premium 10.23. Vulnerability type: XML External Entity Injection (XXE). Root cause / impact: Unauthenticated attacker could exploit misconfigurations in the XML processor to read arbitrary files on the host and steal credentials stored in plain text, potent...

CVE-2019-12924

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

CVE-2019-12923

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

CVE-2019-12923

CVE-2019-12923 affects MailEnable Enterprise Premium (versions around 10.23/10.24). The CSRF protection was not implemented correctly, allowing bypass by removing the anti-CSRF token parameter. This could let an attacker manipulate a user into performing actions in the application (e.g., sending ...

MailEnable Enterprise Premium Access Control Error Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. An Access Control Error vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability arises from a network system or product that does not properly restrict access to...