MDaemon Webmail Cross-Site Request Forgery Vulnerability

MDaemon Technologies MDaemon Webmail formerly known as WorldClient is a Web-based e-mail client for MDaemon Email Server from MDaemon Technologies. A cross-site request forgery vulnerability exists in MDaemon Webmail. The vulnerability stems from a WEB application that does not adequately validat...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

Cross site request forgery (csrf)

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

CVE-2018-17792 affects MDaemon Webmail (WorldClient). It is a Cross-Site Request Forgery (CSRF) in the web client. Exploitation could perform unintended actions for an authenticated user; CVSS2 base score 6.8 (MEDIUM) and CVSS3 base score 8.8 (HIGH) with network access, low attack complexity, no ...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792: Cross-Site Request Forgery (CSRF)

MDaemon Webmail formerly WorldClient has CSRF...

PT-2019-9523

Name of the Vulnerable Software and Affected Versions MDaemon Webmail formerly WorldClient affected versions not specified Description The issue is related to CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations At the moment,...

SquirrelMail 1.4.22 Cross Site Scripting

Advisory ID: SYSS-2019-016 Product: SquirrelMail Manufacturer: The SquirrelMail Project Affected Versions: 1.4.22, SVN Tested Versions: SVN Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2019-04-17 Solution Date: N/A Public...

CVE-2019-12938

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI...

CVE-2019-12938

The CVE-2019-12938 entry concerns Analogic Poste.io 2.1.6, specifically the Roundcube component. The root issue is that .htaccess protection used to guard the logs/ folder is effective with Apache but not with nginx, enabling attackers to access logs through the webmail/logs/sendmail URI. Red Hat...

PT-2019-13037

Name of the Vulnerable Software and Affected Versions Analogic Poste.io version 2.1.6 Description The issue concerns the Roundcube component of Analogic Poste.io, where the protection of the logs/ folder via .htaccess is ineffective when used with the nginx server, as opposed to the Apache HTTP...

Openfind Mail2000 Cross-Site Scripting Vulnerability

Openfind Mail2000 is a Web-based e-mail system. A cross-site scripting vulnerability exists in Webmail in Openfind Mail2000 v6. The vulnerability stems from a lack of proper validation of client data by the web application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2019-9763

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...

CVE-2019-9763

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...

Design/Logic Flaw

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...

CVE-2019-9763

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an 'object data="data:text/html' substring in an e-mail message The vendor subsequently patched this...

CVE-2019-9763

Openfind Mail2000 Webmail (versions 6.0 and 7.0) is affected by a Cross‑Site Scripting vulnerability. The root cause is insufficient validation of client data in Webmail, enabling XSS via an email containing the substring <object data="data:text/html. The vendor subsequently patched this. CVSS...

CVE-2019-9763: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an '...

PT-2019-19854

Name of the Vulnerable Software and Affected Versions Openfind Mail2000 versions 6.0 through 7.0 Description An issue was discovered in Openfind Mail2000 Webmail, where XSS can occur via an 'object data="data:text/html' substring in an e-mail message. Recommendations For Openfind Mail2000 version...