CVE-2021-26294

CVE-2021-26294 affects AfterLogic Aurora and WebMail Pro up to version 7.7.9. It is a directory traversal vulnerability in WebDAV endpoints (dav/server.php) that allows unauthenticated attackers to read arbitrary files (e.g., data/settings/settings.xml) by using crafted paths such as ../..//dav/s...

CVE-2019-16238

CVE-2019-16238 affects Afterlogic Aurora up to version 8.3.9-build-a3, where an XSS vulnerability can be exploited to hijack an administrator session by retrieving the login session cookie. Root cause: insufficient input sanitization enabling script execution in the admin login flow. Impact: pote...

CVE-2021-26293

CVE-2021-26293 affects AfterLogic Aurora and WebMail Pro (DAV enabled). The vulnerability stems from directory traversal in the WebDAV handling (DAVServer.php/DAV/Server.php) that allows creating files under the web root, enabling potential remote code execution via uploaded files. Severity is hi...

CVE-2017-14597

Affected software: AfterLogic WebMail 7.7 and Aurora 7.7.5; component: AdminPanel via adminpanel/modules/pro/inc/ajax.php. Issue: cross-site scripting (XSS) vulnerability exploitable via the txtDomainName field during domain addition. Root cause: improper handling of input in the AdminPanel domai...

CVE-2019-19129

Technical details about CVE-2019-19129 are not publicly provided in the connected documents; no root cause, affected components, or fixes are disclosed. Monitor for updates.