PT-2022-22582

Name of the Vulnerable Software and Affected Versions IceWarp WebClient DC2 version 13.0.2.9 Description A SQL injection issue was found via the search parameter at the "/webmail/server/webmail.php" API endpoint. This allows for potential exploitation. Recommendations For IceWarp WebClient DC2...

CVE-2022-35115: Improper Neutralization of Special Elements used in an SQL Command

IceWarp WebClient DC2 - Update 2 Build 9 13.0.2.9 was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php...

CVE-2011-3579: Undefined Security Weakness

server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service CPU and memory consumption, via an XML external entity declaration in conjunction with an...

PT-2011-4540

Name of the Vulnerable Software and Affected Versions IceWarp Mail Server versions prior to 10.3.3 Description The issue allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is...

CVE-2009-1469: Improper Control of Generation of Code

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element o...

CVE-2009-1468: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...