CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

CVE-2018-17792 affects MDaemon Webmail (WorldClient). It is a Cross-Site Request Forgery (CSRF) in the web client. Exploitation could perform unintended actions for an authenticated user; CVSS2 base score 6.8 (MEDIUM) and CVSS3 base score 8.8 (HIGH) with network access, low attack complexity, no ...

PT-2019-9523

Name of the Vulnerable Software and Affected Versions MDaemon Webmail formerly WorldClient affected versions not specified Description The issue is related to CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations At the moment,...

CVE-2018-17792: Cross-Site Request Forgery (CSRF)

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2019-13612

MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB and limits checks to 10 MB even with special configuration, which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious...

CVE-2019-13612

MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB and limits checks to 10 MB even with special configuration, which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious...

Code injection

MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB and limits checks to 10 MB even with special configuration, which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious...

CVE-2019-13612

MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB and limits checks to 10 MB even with special configuration, which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious...

CVE-2019-13612

CVE-2019-13612 affects MDaemon Email Server 19 through 20.0.1, where SpamAssassin checks are skipped by default for email messages larger than 2 MB and checks are limited to 10 MB even with configured options. The issue arises from the server’s filtering behavior rather than a generic vulnerabili...

PT-2019-13447

Name of the Vulnerable Software and Affected Versions MDaemon Email Server versions 19 through 20.0.1 Description The issue concerns the default behavior of skipping SpamAssassin checks for email messages larger than 2 MB. This behavior might interfere with risk management for malicious email,...

CVE-2019-13612: Improper Input Validation

MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB and limits checks to 10 MB even with special configuration, which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious...

CVE-2019-8983

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...

CVE-2019-8984

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...

CVE-2019-8983

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...

CVE-2019-8984

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...

Cross site scripting

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...

Cross site scripting

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...

CVE-2019-8983

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 1 of 2...

CVE-2019-8984

MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS issue 2 of 2...

CVE-2019-8984

MDaemon Webmail 14.x–18.x before 18.5.2 contains a cross-site scripting (XSS) vulnerability in the web interface. Affected product: MDaemon Webmail; vulnerable versions: 14.x through 18.x prior to 18.5.2. Root cause not detailed in the provided documents. Remediation: upgrade to 18.5.2 or later (...