PT-2013-6137

Name of the Vulnerable Software and Affected Versions PineApp Mail-SeCure affected versions not specified Description The issue allows remote attackers to bypass authentication and perform certain operations. Specifically, it involves the admin/management.html page and the it parameter, which can...

CVE-2013-6827: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter...

PT-2013-6139

Name of the Vulnerable Software and Affected Versions PineApp Mail-SeCure versions 3.70 and earlier Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation in the admin/confnetworking.html page...

CVE-2013-6828: Improper Authentication

admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sysusermng operation via the it parameter...

PT-2013-6138

Name of the Vulnerable Software and Affected Versions PineApp Mail-SeCure affected versions not specified Description The issue allows remote attackers to execute arbitrary commands. This is achieved by injecting shell metacharacters in the pinghost parameter during a ping operation, specifically...

CVE-2013-6829: Improper Control of Generation of Code

admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation...

PineApp MailSecure Command Execution

Hi, related this: http://seclists.org/fulldisclosure/2013/Nov/136 In February 2013 I send Pineapp the following information: ----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https...

CVE-2013-4987

PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command...

Command injection

PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command...

CVE-2013-4987

PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command...

CVE-2013-4987

CVE-2013-4987 affects PineApp Mail-SeCure pre-3.70. It is a local privilege-escalation via an access-control failure: a non-privileged user can obtain a root shell by sending a crafted command in the Mail-SeCure console (example: pa_cli system ping /bin/sh). Root access is achieved locally; all v...

CVE-2013-4987: Undefined Security Weakness

PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command...

PT-2013-5317

Name of the Vulnerable Software and Affected Versions PineApp Mail-SeCure versions prior to 3.70 Description The issue allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command. Recommendations For versions prio...

PineApp Mail-SeCure livelog.html Command Injection

Multiple command Injection vulnerabilities exist in PineApp Mail-SeCure...

PineApp Mail-Secure Command Execution

pineapp makes an anti-spam product, which can be downloaded for vmware, etc. the security of the product is a fucking joke, containing everything from authentication bypass to root exploits. there is really no hope, the developers didnt even try. they can patch those specific vulnerabilities, but...

PineApp Mail-SeCure privilege escalation

Unfiltered shell characters vulnerability...

CORE-2013-0904 - PinApp Mail-SeCure Access Control Failure

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ PinApp Mail-SeCure Access Control Failure 1. Advisory Information Title: PinApp Mail-SeCure Access Control Failure Advisory ID: CORE-2013-0904 Advisory URL:...

PinApp Mail-SeCure Access Control Failure

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ PinApp Mail-SeCure Access Control Failure 1. Advisory Information Title: PinApp Mail-SeCure Access Control Failure Advisory ID: CORE-2013-0904 Advisory URL:...

PinApp Mail-SeCure Access Control Failure

Advisory ID Internal CORE-2013-0904 1. Advisory Information Title: PinApp Mail-SeCure Access Control Failure Advisory ID: CORE-2013-0904 Advisory URL:https://www.coresecurity.com/core-labs/advisories/pinapp-mail-secure-access-control-failure Date published: 2013-10-02 Date of last update:...

PinApp Mail-SeCure Access Control Failure

Core Security Technologies Advisory - A security vulnerability was discovered in PineApp Mail-SeCure Suite, allowing a non-privileged attacker to get a root shell by sending a specially crafted command from the Mail-SeCure console. A valid user account is needed to launch the attack, so this is a...