Mdaemon
by Alt N
CVEs (44)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-27182 | Hig | 0.57 | 8.8 | 0.02 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. | ||
| CVE-2021-27181 | Hig | 0.57 | 8.8 | 0.01 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the… | ||
| CVE-2024-11182 | Med | 0.53 | 6.1 | 0.17 | KEV | Nov 15, 2024 | An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window. | |
| CVE-2006-5708 | Hig | 0.49 | 7.5 | 0.01 | Nov 4, 2006 | Multiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial of service (memory consumption) via unspecified vectors resulting in memory leaks. | ||
| CVE-2021-27183 | Hig | 0.47 | 7.2 | 0.03 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This… | ||
| CVE-2021-27180 | Med | 0.40 | 6.1 | 0.01 | Apr 14, 2021 | An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user. | ||
| CVE-2019-8984 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). | ||
| CVE-2019-8983 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). | ||
| CVE-2002-1739 | Med | 0.36 | 5.5 | 0.00 | Dec 31, 2002 | Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords. | ||
| CVE-2022-29976 | Med | 0.35 | 5.4 | 0.00 | May 11, 2022 | An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . | ||
| CVE-2022-29975 | Med | 0.35 | 5.4 | 0.00 | May 11, 2022 | An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . | ||
| CVE-2008-1358 | 0.08 | — | 0.57 | Mar 17, 2008 | Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY. | |||
| CVE-2006-4364 | 0.08 | — | 0.57 | Aug 27, 2006 | Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via long strings that contain '@' characters in the (1) USER and (2) APOP… | |||
| CVE-2003-1200 | 0.08 | — | 0.65 | Dec 29, 2003 | Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi. | |||
| CVE-2008-2631 | 0.05 | — | 0.23 | Jun 10, 2008 | The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted HTTP POST request. NOTE: the provenance of this information is unknown; the details are obtained… | |||
| CVE-2004-1546 | 0.05 | — | 0.31 | Dec 31, 2004 | Multiple buffer overflows in MDaemon 6.5.1 allow remote attackers to cause a denial of service (application crash) via a long (1) SAML, SOML, SEND, or MAIL command to the SMTP server or (2) LIST command to the IMAP server. | |||
| CVE-2012-2584 | 0.03 | — | 0.03 | Aug 12, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the… | |||
| CVE-2006-2646 | 0.03 | — | 0.05 | May 30, 2006 | Buffer overflow in Alt-N MDaemon, possibly 9.0.1 and earlier, allows remote attackers to execute arbitrary code via a long A0001 argument that begins with a '"' (double quote). | |||
| CVE-2006-0925 | 0.03 | — | 0.03 | Feb 28, 2006 | Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers. | |||
| CVE-2005-4209 | 0.03 | — | 0.02 | Dec 13, 2005 | WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message, which prevents the user from being able to access the Inbox folder, possibly due to a cross-site… |
- risk 0.57cvss 8.8epss 0.02
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the…
- risk 0.53cvss 6.1epss 0.17
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
- risk 0.49cvss 7.5epss 0.01
Multiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial of service (memory consumption) via unspecified vectors resulting in memory leaks.
- risk 0.47cvss 7.2epss 0.03
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
- risk 0.36cvss 5.5epss 0.00
Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.
- risk 0.35cvss 5.4epss 0.00
An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .
- risk 0.35cvss 5.4epss 0.00
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .
- CVE-2008-1358Mar 17, 2008risk 0.08cvss —epss 0.57
Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.
- CVE-2006-4364Aug 27, 2006risk 0.08cvss —epss 0.57
Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via long strings that contain '@' characters in the (1) USER and (2) APOP…
- CVE-2003-1200Dec 29, 2003risk 0.08cvss —epss 0.65
Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
- CVE-2008-2631Jun 10, 2008risk 0.05cvss —epss 0.23
The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted HTTP POST request. NOTE: the provenance of this information is unknown; the details are obtained…
- CVE-2004-1546Dec 31, 2004risk 0.05cvss —epss 0.31
Multiple buffer overflows in MDaemon 6.5.1 allow remote attackers to cause a denial of service (application crash) via a long (1) SAML, SOML, SEND, or MAIL command to the SMTP server or (2) LIST command to the IMAP server.
- CVE-2012-2584Aug 12, 2012risk 0.03cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the…
- CVE-2006-2646May 30, 2006risk 0.03cvss —epss 0.05
Buffer overflow in Alt-N MDaemon, possibly 9.0.1 and earlier, allows remote attackers to execute arbitrary code via a long A0001 argument that begins with a '"' (double quote).
- CVE-2006-0925Feb 28, 2006risk 0.03cvss —epss 0.03
Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers.
- CVE-2005-4209Dec 13, 2005risk 0.03cvss —epss 0.02
WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message, which prevents the user from being able to access the Inbox folder, possibly due to a cross-site…
Page 1 of 3