Winmail Server 4.2 Cross Site Scripting

Winmail Server 4.2 Reflected XSS Cross-site Scripting Web Application 0-Day Security Bug Exploit Title: Winmail Server badlogin.php &lid parameter Reflected XSS Web Security Vulnerability Product: Winmail Server Vendor: Winmail Server Vulnerable Versions: 4.2 4.1 Tested Version: 4.2 4.1 Advisory...

winmail邮件系统存储型跨站

简要描述： winmail最近刚刚升级为最新版本，但系统存在一处XSS漏洞，利用该漏洞，我们可以盗取任意用户邮件内容和COOKIE信息，以及进行一些其他恶意操作。 详细说明： 1、涉及版本：Winmail Mail Server5.5 2、winmail邮件系统对发件人字段进行了过滤，但是在回复邮件时，系统会重新读取发件人，系统重新读取后，并没有对发件人字段进行过滤，导致存储型XSS的触发。 3、系统演示站点：http://demo.magicwinmail.com:6080/ 漏洞证明： 1、登录系统--》配置箱--》使用偏好，将发件人名字改为...

Magic Winmail Server 4.0 (Build 1112) upload.php Traversal Arbitrary File Upload

No description provided by source. source: http://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads...

Magic Winmail Server 4.0 (Build 1112) download.php Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads...

Magic Winmail Server 2.3 USER POP3 Command Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7667/info A format string vulnerability has been reported for Magic Winmail Server when processing the USER POP3 command. An attacker may exploit this vulnerability by connecting to the vulnerable mail server and issuing...

Winmail Mail Server 2.3 - Remote Format String Exploit

No description provided by source...

Winmail邮件正文存储型xss（有触发条件）

简要描述： 一款功能风格很像qq邮箱的产品，可惜安全比qq邮箱差一些 详细说明： 简单的说就是正文作了处理，但是用户回复或者转发时没做好处理，导致了存储型XSS。 用户A给用户B发送邮件，正文部分可以写一篇很长的个人感情带color的故事或者B喜欢的某类风格文字来吸引B看下去（为何要长，待下面说明），在正文的最后加上xss语句： 点击发送，B用户收到邮件打开第一眼一看是看不到xss code的 ，所以标题起的诱惑点，正文长一点，用户极有可能就直接转发给需要通知的人了，而在用户回复或者转发邮件的时候即触发XSS...

WinMail Server 4.4 build 1124 (WebMail) Remote Add Super User Exploit

No description provided by source. ?php / WinMail Server 4.4 build 1124 WebMail remote add new Super User exploit by rgod software site: http://www.magicwinmail.net/download.asp vulnerable code in /inc/class.session.php at lines 8-25: ... function Load $result = Array; $sessionfile =...

WinMail Server 4.4 build 1124 (WebMail) Remote Add Super User Exploit

Exploit for unknown platform in category web applications ===================================================================== WinMail Server 4.4 build 1124 WebMail Remote Add Super User Exploit =====================================================================...

WinMail Server 4.4 build 1124 - 'WebMail' Remote Add Super User

tempfolder."sessions/".$this-sid.".sess"; if!fileexists$sessionfile return false; $size = filesize$sessionfile; $fp = fopen$sessionfile, "rb"; if $fp $result = fread$fp, $size; fclose$fp; $result = unserializebase64decode$result; return $result; ... This function should check for session files...

Winmail Mail Server 2.3 Remote Format String Exploit

No description provided by source. / Magic Winmail Server 2.3Build 0402 Remote Format string exploit. Coded by ThreaT. This one take advantage of a format bug in the SMTP protocol not pop3 for execute a malicious command on a vulnerable system usage : mwmxploit Target IP command to execute remote...

Winmail Server Webmail Unspecified Vulnerability

The remote host is running Winmail Server, a commercial mail server for Windows from AMAX Information Technologies. According to its version number, the remote installation of Winmail Server is affected by an unknown issue in its webmail component. It is unclear whether this is the same issue...

Design/Logic Flaw

Unspecified vulnerability in the Webmail module in Winmail before 4.3 has unknown impact and unknown remote attack vectors...

CVE-2006-1250

Unspecified vulnerability in the Webmail module in Winmail before 4.3 has unknown impact and unknown remote attack vectors...

CVE-2006-1250

Unspecified vulnerability in the Webmail module in Winmail before 4.3 has unknown impact and unknown remote attack vectors...

CVE-2006-1250

Technical details for CVE-2006-1250 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2005-3811

Directory traversal vulnerability in admin/main.php in AMAX Magic Winmail Server 4.2 build 0824 and earlier allows remote attackers to overwrite arbitrary files with session information via the sid parameter...

CVE-2005-3811

CVE-2005-3811 describes a directory traversal vulnerability in AMAX Magic Winmail Server 4.2 (build 0824) and earlier, exploitable remotely via the sid parameter in admin/main.php to overwrite arbitrary files using session information. Affected product: Winmail Server (AMAX) versions 4.2 and earl...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 is affected. The vulnerability arises from improper processing of the $keyword variable in the netaddressbook.php form, causing ldap_search failures to reveal the local path via ldaplib.php error messages. This leads to information disclosure through invalid characte...

KLA10399 Multiple vulnerabilities in Winmail

Multiple serious vulnerabilities have been found in Winmail Server. Malicious users can exploit these vulnerabilities to inject scripts or overwrite local files. Below is a complete list of vulnerabilities 1. A directory traversal can be exploited remotely via a side parameter; 2. An XSS...