Design/Logic Flaw

Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section...

Directory traversal

Absolute path directory traversal vulnerability in 1 MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and 2 VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname i...