CVE-2015-9277

MailEnable before 8.60 is affected by a directory traversal due to mishandling of /../ and /.. / sequences, allowing an attacker to read other users’ messages and potentially upload and delete files. Affected product: MailEnable (before 8.60). Root cause: improper normalization of path traversal ...

CVE-2015-9278

Summary: MailEnable before 8.60 is vulnerable to privilege escalation due to incorrect handling of the %0A sequence in AUTH.TAB after a password-change request, enabling an attacker to create or modify admin-like accounts. Affected product/versions: MailEnable prior to 8.60. Root cause: mishandli...

PT-2019-7237

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60 Description The issue allows for Directory Traversal, enabling unauthorized actions such as reading messages of other users, uploading files, and deleting files. This is due to the mishandling of "/../" and "/...

PT-2019-7238

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60 Description The issue allows for privilege escalation due to the mishandling of %0A in AUTH.TAB after a password-change request, which could lead to the creation of admin accounts. Recommendations For versions...

PT-2019-7240

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60 Description The issue allows for XXE XML External Entity attacks through an XML document in the request.aspx Options parameter. Recommendations For versions prior to 8.60, update to version 8.60 or later to...

PT-2019-7239

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60 Description The issue allows for Stored XSS attacks through the use of a malformed "" character in the body of an e-mail message. Recommendations For MailEnable versions prior to 8.60, update to version 8.60 o...

CVE-2015-9278: Undefined Security Weakness

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request...

CVE-2015-9277: Improper Limitation of a Pathname to a Restricted Directory

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled...

CVE-2015-9280: Improper Restriction of XML External Entity Reference

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...

CVE-2015-9279: Improper Neutralization of Input During Web Page Generation

MailEnable before 8.60 allows Stored XSS via malformed use of " " character in the body of an e-mail message...

MailEnable Local Privilege Escalation

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILENABLE-MULTIPLE-PRIVILEGE-ESCALATIONS.txt + ISR: ApparitionSec Vendor: =================== www.mailenable.com Products: ============ MailEnable MailEnable provides Windows...

MailEnable Multiple Local Privilege Escalations Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILENABLE-MULTIPLE-PRIVILEGE-ESCALATIONS.txt + ISR: ApparitionSec Vendor: =================== www.mailenable.com...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

CVE-2012-2588

CVE-2012-2588 is an XSS vulnerability in MailEnable Enterprise 6.5. The issue allows remote attackers to inject arbitrary web script or HTML via SMTP message fields (From, To, Subject) or the message body, exploiting malformed headers/body to execute scripts in a user’s context. Public references...

CVE-2012-2588: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

PT-2014-2252

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise version 6.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parts of an SMTP e-mail messag...

MailEnable Pro/Ent <= 2.37 (APPEND) Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl maildisable-v4.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Wed Nov 29 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.35 win32...

MailEnable Mail Server HTTPMail 1.x Remote Heap Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10312/info MailEnable is a commercially available POP3 and SMTP server for the Windows platform. The 'Professional' and 'Enterprise' editions of MailEnable are reported to be prone to a remote heap buffer overflow. The...