The vulnerability in the web console of the Kaspersky Secure Mail Gateway security tool, which allows access to the root user rights.

The vulnerability of the Kaspersky Secure Mail Gateway web console relates to deficiencies in the process of eliminating special elements from the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain root user privilege...

Kaspersky Secure Mail Gateway Cross-Site Request Forgery Vulnerability

Kaspersky Secure Mail Gateway is an email security solution from Russia's Kaspersky Lab. The program is able to automatically filter spam, phishing sites and various malicious attachments. A cross-site request forgery vulnerability exists in Kaspersky Secure Mail Gateway version 1.1. A remote...

Kaspersky Secure Mail Gateway Configuration File Injection Vulnerability

Kaspersky Secure Mail Gateway is an email security solution from Russia's Kaspersky Lab. The program is able to automatically filter spam, phishing sites and various malicious attachments. A security vulnerability exists in Kaspersky Secure Mail Gateway version 1.1. An attacker can exploit the...

Kaspersky Secure Mail Gateway Local Elevation of Privilege Vulnerability

Kaspersky Secure Mail Gateway is a suite of email security solutions from Russia's Kaspersky Lab. Kaspersky Secure Mail Gateway suffers from a security vulnerability that allows a local attacker to exploit the vulnerability by submitting special requests for elevated privileges...

Kaspersky Secure Mail Gateway Cross-Site Scripting Vulnerability

Kaspersky Secure Mail Gateway is an email security solution from Russia's Kaspersky Lab. The program is able to automatically filter spam, phishing sites and various malicious attachments. A cross-site scripting vulnerability exists in Kaspersky Secure Mail Gateway version 1.1. A remote attacker...

Privilege escalation

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...

Design/Logic Flaw

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6290

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6289

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

Cross site scripting

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

Cross site request forgery (csrf)

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6289

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6291

Kaspersky Secure Mail Gateway 1.1.0.379 web management console contains multiple vulnerabilities described in CORE-2017-0010, including CVE-2018-6291 (Reflected XSS in importSettings callback) and related CVEs (CVE-2018-6288/6289/6290) enabling CSRF, remote command execution as root via crafted s...

CVE-2018-6290

CVE-2018-6290 is a local privilege escalation in Kaspersky Secure Mail Gateway 1.1.0.379 where a setuid root binary at /opt/kaspersky/klms-appliance/libexec/upgrade/upgrade_launcher can be abused by a kluser to run a malicious Python script, elevating privileges to root. The Core Security advisor...