CVE-2020-13376

CVE-2020-13376 affects SecurEnvoy SecurMail 9.3.503. A vulnerability in the SecurEnvoyReply cookie allows an attacker to upload executable files and achieve OS command execution. The issue is described as a file-upload/command-injection vector enabling remote code execution; CVSS metrics in sourc...

CVE-2018-7701

CVE-2018-7701 covers CSRF vulnerabilities in SecurEnvoy SecurMail

CVE-2018-7702

CVE-2018-7702 affects SecurEnvoy SecurMail prior to 9.2.501. The flaw allows remote attackers to spoof transmission of arbitrary emails, resend messages to arbitrary recipients, or modify message bodies/attachments by leveraging missing authentication and authorization. The root cause is insuffic...

CVE-2018-7706

CVE-2018-7706 affects SecurEnvoy SecurMail prior to 9.2.501. A directory-traversal flaw in the attachment action to secmail/getmessage.exe can be exploited by remote authenticated users to read arbitrary emails via the ".." sequence in the option2 parameter. The condition is tied to a pre-9.2.501...

CVE-2018-7705

SecurEnvoy SecurMail vulnerability CVE-2018-7705 is a directory traversal flaw in secupload2/upload.aspx that allows remote authenticated users to read emails to arbitrary recipients. Affected products are SecurEnvoy SecurMail versions before 9.2.501; the issue is fixed in 9.2.501 or newer. Impac...

CVE-2018-7707

Affected software : SecurEnvoy SecurMail prior to 9.2.501. Vulnerability : Cross-site scripting (XSS) via an HTML-formatted e-mail message. Root cause / vector : not explicitly detailed beyond the XSS in HTML-format emails; multiple sources attribute vulnerability to improper handling of HTML ema...

CVE-2018-7703

CVE-2018-7703 describes an XSS vulnerability in SecurEnvoy SecurMail prior to 9.2.501. The issue allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe. Affected product: SecurMail (SecurEnvoy). Root cause: improper handling of the mai...

CVE-2018-7704

CVE-2018-7704 affects SecurEnvoy SecurMail prior to 9.2.501. The vulnerability allows remote authenticated users to read arbitrary email messages via the option1 parameter in a reply action to secmail/getmessage.exe, exposing confidential data. Root cause described across sources is an insecure h...