CVE-2020-26554

REDDOXX MailDepot 2033 (2.3.3022) is affected by a persistent Cross-site Scripting (XSS) in incoming HTML e-mails (CWE-79). The SySS advisory SYSS-2020-037 indicates the vulnerability arises from processing HTML mail, allowing script execution in the context of the user’s browser when viewing mes...

CVE-2019-19200

REDDOXX MailDepot 2032 SP2 (version 2.2.1242) is affected by CVE-2019-19200 due to an improper authorization weakness. The vulnerability allows authenticated users to access other users’ mailboxes, effectively an authorization bypass. The issue was disclosed in an advisory (SYSS-2019-048) and pub...

CVE-2019-19199

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration: tokens are not invalidated on logout. Documented as CVE-2019-19199 (CWE-613). SYSS advisory SYSS-2019-049 (PacketStorm) lists the vulnerability type and notes a fix with Solution Date 2020-06-09 and Public Disclosure 2020-09...