714 matches found
MDaemon-Advisories
MDaemon-Advisories MDaemon アドバイザリ: CVE-2021-27180 反射型XSS CVE-2021-27181 CSRFトークン固定化 CVE-2021-27182 iframeインジェクション CVE-2021-27183 リモートコード実行 これらの脆弱性は2021年1月にすでに修正されており、CVE登録の目的で公開されています。これらを連鎖させることで、メールメッセージを介したRCE/アカウント乗っ取りを達成できます ユーザーの操作が必要。 タイムライン: 2020年12月15日: ベンダーに脆弱性レポートを送付 2021年1月12日: パッチ公開...
Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection
Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...
Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS
The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...
The vulnerability of the MDaemon email server, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code and gain unauthorized access to confidential information.
The vulnerability of the MDaemon email server is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to confidential information...
CVE-2022-37238
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting XSS via the currentRequest parameter...
CVE-2022-37243
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting XSS via the whitelist endpoint...
CVE-2022-37239
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting XSS via the rulleslistajax endpoint...
CVE-2022-37240
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter...
CVE-2022-37244
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection...
CVE-2025-61084
MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...
CVE-2025-61084
MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...
PT-2025-45105
Name of the Vulnerable Software and Affected Versions MDaemon Mail Server version 23.5.2 Description MDaemon Mail Server version 23.5.2 validates Sender Policy Framework SPF, DomainKeys Identified Mail DKIM, and Domain-based Message Authentication, Reporting & Conformance DMARC using the email...
MDaemon Mail Server 安全漏洞
MDaemon Mail Server is an e-mail server software from MDaemon Inc. in the United States. A security vulnerability exists in MDaemon Mail Server version 23.5.2, which originates from a flaw in the use of email validation SPF, DKIM, and DMARC using the pointed brackets in the From header of the SMT...
CVE-2025-61084
MDaemon Mail Server version 23.5.2 is vulnerable to an email spoofing attack due to improper input validation. The software validates SPF, DKIM, and DMARC using the email address enclosed in angle brackets () within the From: header of SMTP DATA. An attacker can craft a header containing multiple...
CVE-2025-61084
MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...
CVE-2025-61084: Improper Input Validation
MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...
EUVD-2002-1720
Malware in sbrugna...
EUVD-2021-13950
Malware in sbrugna...