Webmail
by Alt N
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-27182 | Hig | 0.57 | 8.8 | 0.02 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. | ||
| CVE-2018-17792 | Hig | 0.57 | 8.8 | 0.01 | Jul 19, 2019 | MDaemon Webmail (formerly WorldClient) has CSRF. | ||
| CVE-2021-27180 | Med | 0.40 | 6.1 | 0.01 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user. | ||
| CVE-2019-8984 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). | ||
| CVE-2019-8983 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). | ||
| CVE-2020-18724 | Med | 0.38 | 5.4 | 0.03 | Feb 3, 2021 | Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list. | ||
| CVE-2020-18723 | Med | 0.38 | 5.4 | 0.04 | Feb 3, 2021 | Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities. |
- risk 0.57cvss 8.8epss 0.02
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
- risk 0.57cvss 8.8epss 0.01
MDaemon Webmail (formerly WorldClient) has CSRF.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
- risk 0.38cvss 5.4epss 0.03
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
- risk 0.38cvss 5.4epss 0.04
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.