SecurEnvoy SecurMail Cross-Site Request Forgery Vulnerability

SecurEnvoy SecurMail is an email application from SecurEnvoy USA. A cross-site request forgery vulnerability exists in SecurEnvoy SecurMail versions prior to 9.2.501. A remote attacker can exploit this vulnerability by sending requests to the files secmail/getmessage.exe and...

SecurEnvoy SecurMail Cross-Site Scripting Vulnerability (CNVD-2018-06275)

SecurEnvoy SecurMail is an email application from SecurEnvoy USA. A cross-site scripting vulnerability exists in versions of SecurEnvoy SecurMail prior to 9.2.501. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via HTML formatted email messages...

SecurEnvoy SecurMail Directory Traversal Vulnerability

SecurEnvoy SecurMail is an email application from SecurEnvoy USA. A directory traversal vulnerability exists in SecurEnvoy SecurMail versions prior to 9.2.501. A remote attacker can send a directory traversal vulnerability to the secupload2/upload.aspx file by sending a file with the '...' sequen...

CVE-2018-7706

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

CVE-2018-7703

CVE-2018-7703 describes an XSS vulnerability in SecurEnvoy SecurMail prior to 9.2.501. The issue allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe. Affected product: SecurMail (SecurEnvoy). Root cause: improper handling of the mai...

CVE-2018-7705

SecurEnvoy SecurMail vulnerability CVE-2018-7705 is a directory traversal flaw in secupload2/upload.aspx that allows remote authenticated users to read emails to arbitrary recipients. Affected products are SecurEnvoy SecurMail versions before 9.2.501; the issue is fixed in 9.2.501 or newer. Impac...

CVE-2018-7704

CVE-2018-7704 affects SecurEnvoy SecurMail prior to 9.2.501. The vulnerability allows remote authenticated users to read arbitrary email messages via the option1 parameter in a reply action to secmail/getmessage.exe, exposing confidential data. Root cause described across sources is an insecure h...

CVE-2018-7702

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization...

CVE-2018-7701

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2018-7707

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...

CVE-2018-7707

Affected software : SecurEnvoy SecurMail prior to 9.2.501. Vulnerability : Cross-site scripting (XSS) via an HTML-formatted e-mail message. Root cause / vector : not explicitly detailed beyond the XSS in HTML-format emails; multiple sources attribute vulnerability to improper handling of HTML ema...

CVE-2018-7702

CVE-2018-7702 affects SecurEnvoy SecurMail prior to 9.2.501. The flaw allows remote attackers to spoof transmission of arbitrary emails, resend messages to arbitrary recipients, or modify message bodies/attachments by leveraging missing authentication and authorization. The root cause is insuffic...

CVE-2018-7705

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

CVE-2018-7704

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7703

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe...

CVE-2018-7706

CVE-2018-7706 affects SecurEnvoy SecurMail prior to 9.2.501. A directory-traversal flaw in the attachment action to secmail/getmessage.exe can be exploited by remote authenticated users to read arbitrary emails via the ".." sequence in the option2 parameter. The condition is tied to a pre-9.2.501...

CVE-2018-7701

CVE-2018-7701 covers CSRF vulnerabilities in SecurEnvoy SecurMail

SecurEnvoy SecurMail 9.1.501 XSS / CSRF / Traversal

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: SecurEnvoy SecurMail vulnerable version: 9.1.501 fixed version: 9.2.501 or hotfix patch "1012018" CVE number: CVE-2018-7701,...