Show filters
65 Total Results
Displaying 21-30 of 65
Sort by:
Attacker Value
Unknown
CVE-2010-5335
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.
0
Attacker Value
Unknown
CVE-2010-5337
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
0
Attacker Value
Unknown
CVE-2010-5339
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.
0
Attacker Value
Unknown
CVE-2010-5338
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0.
0
Attacker Value
Unknown
CVE-2010-5334
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.
0
Attacker Value
Unknown
CVE-2019-19265
Disclosure Date: August 07, 2019 (last updated February 21, 2025)
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
0
Attacker Value
Unknown
CVE-2019-12593
Disclosure Date: June 03, 2019 (last updated November 27, 2024)
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.
0
Attacker Value
Unknown
CVE-2018-16324
Disclosure Date: September 01, 2018 (last updated November 27, 2024)
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
0
Attacker Value
Unknown
CVE-2018-7475
Disclosure Date: June 30, 2018 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
0
Attacker Value
Unknown
CVE-2015-1503
Disclosure Date: May 08, 2018 (last updated November 26, 2024)
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
0
