CVE-2019-12923: Cross-Site Request Forgery (CSRF)

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery CSRF protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly...

CVE-2019-12924: Missing Encryption of Sensitive Data

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection XXE attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all...

MailEnable Cross-Site Scripting Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in the mail settings in MailEnable versions prior to 8.60. The vulnerability can be exploited by an attacker to read local files or scan the internal network by sending the...

MailEnable cross-site scripting vulnerability (CNVD-2019-27601)

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in MailEnable versions prior to 8.60. An attacker can exploit this vulnerability to execute JavaScript code by sending an email...

MailEnable Path Traversal Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A directory traversal vulnerability exists in MailEnable versions prior to 8.60, which stems from the program incorrectly handling '/... /' and '/... /' sequences. An attacker could exploit this vulnerability to read...

MailEnable Trust Management Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A security vulnerability exists in MailEnable versions prior to 8.60. The vulnerability stems from AUTH.TAB incorrectly handling the '%0A' sequence after receiving a password change request. An attacker can exploit the...

Cross site request forgery (csrf)

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

Design/Logic Flaw

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

Design/Logic Flaw

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

Directory traversal

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "" character in the body of an e-mail message...

CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

CVE-2015-9279

CVE-2015-9279 affects MailEnable prior to version 8.60. The issue is a Stored XSS via malformed HTML in email bodies where a tag like "" character, enabling script execution. Affected component is MailEnable’s mail server rendering/processing of email content (stored XSS). Impact described in sou...

CVE-2015-9280

MailEnable before 8.60 is vulnerable to an XML External Entity (XXE) attack via an XML document in the request.aspx Options parameter, per CVE-2015-9280. The vulnerability affects MailEnable's handling of XML in that parameter and can lead to high-severity impact, with CVSSv3.1 base score 10.0 (C...