8 matches found
Code injection
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...
CVE-2018-7703
CVE-2018-7703 describes an XSS vulnerability in SecurEnvoy SecurMail prior to 9.2.501. The issue allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe. Affected product: SecurMail (SecurEnvoy). Root cause: improper handling of the mai...
CVE-2018-7704
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...
CVE-2018-7704: Exposure of Sensitive Information to an Unauthorized Actor
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...
CVE-2018-7701: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...
CVE-2018-7706: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...
CVE-2018-7703: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe...