eMail Server
by IceWarp
CVEs (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-14066 | Hig | 0.57 | 8.8 | 0.02 | Jul 15, 2020 | IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access. | ||
| CVE-2015-1503 | Hig | 0.56 | 7.5 | 0.58 | May 8, 2018 | Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or… | ||
| CVE-2020-8512 | Med | 0.44 | 6.1 | 0.15 | Feb 1, 2020 | In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. | ||
| CVE-2020-14065 | Med | 0.42 | 6.5 | 0.01 | Jul 15, 2020 | IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space. | ||
| CVE-2020-14064 | Med | 0.42 | 6.5 | 0.01 | Jul 15, 2020 | IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts. | ||
| CVE-2019-19265 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts. | ||
| CVE-2018-7475 | Med | 0.40 | 6.1 | 0.01 | Jun 30, 2018 | Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2019-19266 | Med | 0.35 | 5.4 | 0.01 | Jan 6, 2020 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects. | ||
| CVE-2017-12844 | Med | 0.31 | 4.8 | 0.01 | Aug 23, 2017 | Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name. | ||
| CVE-2009-1469 | 0.03 | — | 0.05 | May 5, 2009 | CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the… | |||
| CVE-2009-1467 | 0.03 | — | 0.04 | May 5, 2009 | Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML… |
- risk 0.57cvss 8.8epss 0.02
IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.
- risk 0.56cvss 7.5epss 0.58
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or…
- risk 0.44cvss 6.1epss 0.15
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
- risk 0.42cvss 6.5epss 0.01
IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
- risk 0.42cvss 6.5epss 0.01
IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
- risk 0.40cvss 6.1epss 0.01
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.35cvss 5.4epss 0.01
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name.
- CVE-2009-1469May 5, 2009risk 0.03cvss —epss 0.05
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the…
- CVE-2009-1467May 5, 2009risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML…