4840 matches found
CVE-2019-14387
CVE-2019-14387 affects cPanel before 82.0.2, with a Self XSS vulnerability in the cPanel and webmail master templates (SEC-506). Root cause is client-side script execution via crafted input in template code. Impact, per CVSS data, is MEDIUM: network access with exploitation requiring user interac...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
CVE-2019-14387: Improper Neutralization of Input During Web Page Generation
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
MDaemon Webmail Cross-Site Request Forgery Vulnerability
MDaemon Technologies MDaemon Webmail formerly known as WorldClient is a Web-based e-mail client for MDaemon Email Server from MDaemon Technologies. A cross-site request forgery vulnerability exists in MDaemon Webmail. The vulnerability stems from a WEB application that does not adequately validat...
CVE-2018-17792
MDaemon Webmail formerly WorldClient has CSRF...
CVE-2018-17792
MDaemon Webmail formerly WorldClient has CSRF...
Cross site request forgery (csrf)
MDaemon Webmail formerly WorldClient has CSRF...
CVE-2018-17792
MDaemon Webmail formerly WorldClient has CSRF...
CVE-2018-17792
CVE-2018-17792 affects MDaemon Webmail (WorldClient). It is a Cross-Site Request Forgery (CSRF) in the web client. Exploitation could perform unintended actions for an authenticated user; CVSS2 base score 6.8 (MEDIUM) and CVSS3 base score 8.8 (HIGH) with network access, low attack complexity, no ...
CVE-2018-17792: Cross-Site Request Forgery (CSRF)
MDaemon Webmail formerly WorldClient has CSRF...
SquirrelMail 1.4.22 Cross Site Scripting
Advisory ID: SYSS-2019-016 Product: SquirrelMail Manufacturer: The SquirrelMail Project Affected Versions: 1.4.22, SVN Tested Versions: SVN Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2019-04-17 Solution Date: N/A Public...
CVE-2019-12938
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI...
CVE-2019-12938
The CVE-2019-12938 entry concerns Analogic Poste.io 2.1.6, specifically the Roundcube component. The root issue is that .htaccess protection used to guard the logs/ folder is effective with Apache but not with nginx, enabling attackers to access logs through the webmail/logs/sendmail URI. Red Hat...
Openfind Mail2000 Cross-Site Scripting Vulnerability
Openfind Mail2000 is a Web-based e-mail system. A cross-site scripting vulnerability exists in Webmail in Openfind Mail2000 v6. The vulnerability stems from a lack of proper validation of client data by the web application. An attacker can exploit this vulnerability to execute client-side code...
CVE-2019-9763
An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...
CVE-2019-9763
An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...
Design/Logic Flaw
An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...
CVE-2019-9763
An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...
CVE-2019-9763
Openfind Mail2000 Webmail (versions 6.0 and 7.0) is affected by a Cross‑Site Scripting vulnerability. The root cause is insufficient validation of client data in Webmail, enabling XSS via an email containing the substring <object data="data:text/html. The vendor subsequently patched this. CVSS...