Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

251 results · page 2 of 6

Nov 28, 2022A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website.CVE-2022-41675 · Other software · TEAM JOHNLONG SOFTWARE CO., LTD. · reported by twcert@cert.org.twHigh 8
A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.
Product
MAILD Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.CVE-2022-37238 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.CVE-2022-37245 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter.CVE-2022-37244 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.CVE-2022-37243 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.CVE-2022-37242 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.CVE-2022-37241 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.CVE-2022-37240 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.CVE-2022-37239 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
May 4, 2022Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.CVE-2022-28076 · Other software · Seacms · reported by MITREHigh 7.2
Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.
Product
Seacms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 4, 2022A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.CVE-2021-43462 · Other software · Rumble Mail Server Project · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.
Product
Rumble Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Apr 4, 2022Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.CVE-2021-43461 · Other software · Rumble Mail Server Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.
Product
Rumble Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Apr 4, 2022A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters.CVE-2021-43459 · Other software · Rumble Mail Server Project · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters.
Product
Rumble Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Apr 4, 2022An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path.CVE-2021-43456 · Other software · Rumble Mail Server Project · reported by MITREHigh 7.8
An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path.
Product
Rumble Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com github.com
Mar 9, 2022Maddy Mail Server is an open source SMTP compatible email server.CVE-2022-24732 · Other software · foxcpp · reported by GitHubMedium 6.3
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
Product
maddy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2021WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_paramCVE-2021-28975 · Other software · Wpmailster · reported by MITREMedium 6.1
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.
Product
WP Mailster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record compass-security.com compass-security.com
Aug 3, 2021An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5.CVE-2021-38084 · Other software · Courier-mta · reported by MITREHigh 8.1
An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session.
Product
Courier Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Jul 30, 2021report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause aCVE-2021-36386 · Other software · Fetchmail · reported by MITREHigh 7.5
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Product
Fetchmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Nov 2, 2020IceWarp 11.4.5.0 allows XSS via the language parameter.CVE-2020-27982 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp 11.4.5.0 allows XSS via the language parameter.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cxsecurity.com
Sep 11, 2020ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution.CVE-2020-23824 · Other software · Argosoft · reported by MITREHigh 8.8
ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component is the Administration dashboard. When using admin/user credentials, if the admin/user admin opens a website with the malicious page that will run the CSRF.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.CVE-2020-14066 · Other software · Icewarp · reported by MITREHigh 8.8
IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.CVE-2020-14065 · Other software · Icewarp · reported by MITREMedium 6.5
IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.CVE-2020-14064 · Other software · Icewarp · reported by MITREMedium 6.5
IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Mar 13, 2020Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request.CVE-2020-10541 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.
Product
Manageengine Opmanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Feb 6, 2020Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or CVE-2012-2593 · Other software · Atmail · reported by cret@cert.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
Product
Atmail Webmail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jan 31, 2020In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.CVE-2020-8512 · Other software · Icewarp · reported by MITREMedium 6.1
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
Product
Icewarp Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cxsecurity.com
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.CVE-2019-19265 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org redteam-pentesting.de
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.CVE-2019-19266 · Other software · Icewarp · reported by MITREMedium 5.4
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org redteam-pentesting.de
Dec 17, 2019MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.CVE-2019-19497 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
Product
Mdaemon Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com twitter.com
Jul 16, 2019MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special cCVE-2019-13612 · Other software · Altn · reported by MITREHigh 7.5
MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious e-mail, if a customer deploys a server with sufficient resources to scan large messages.
Product
Mdaemon Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.altn.com lists.altn.com
Jun 3, 2019IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.CVE-2019-12593 · Other software · Icewarp · reported by MITREHigh 7.5
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 12, 2019Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body.CVE-2019-9557 · Other software · Codecrafters · reported by MITREMedium 6.1
Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
Product
Ability Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 5, 2018Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.CVE-2018-18949 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
Product
Manageengine Opmanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Sep 1, 2018In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.CVE-2018-16324 · Other software · Icewarp · reported by MITREMedium 6.1
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Jun 30, 2018Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.CVE-2018-7475 · Other software · Icewarp · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0xd0ff9.wordpress.com youtube.com
May 8, 2018Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) ..CVE-2015-1503 · Other software · Icewarp · reported by MITREHigh 7.5
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 14, 2018Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/cCVE-2018-5700 · Other software · Magicwinmail · reported by MITREHigh 8.8
Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/class.ftpfolder.php) to move a .php file from the FTP folder into a web folder.
Product
Winmail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 20, 2017Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_reaCVE-2017-17752 · Other software · Codecrafters · reported by MITREMedium 6.1
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
Product
Ability Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 24, 2017Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory consumption) via unspeciCVE-2017-15223 · Other software · Argosoft · reported by MITREMedium 5.3
Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory consumption) via unspecified vectors, possibly triggering an infinite loop.
Product
Mini Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 23, 2017Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitraCVE-2015-5379 · Other software · Axigen · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment.
Product
Axigen Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 2, 2017Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmCVE-2017-12639 · Other software · Ipswitch · reported by MITRECritical 9.8
Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETRE or ETCTERARED.
Product
Imail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.ipswitch.com docs.ipswitch.com
Oct 2, 2017Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmCVE-2017-12638 · Other software · Ipswitch · reported by MITRECritical 9.8
Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETBL or ETCETERABLUE.
Product
Imail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.ipswitch.com docs.ipswitch.com
Aug 23, 2017Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary CVE-2017-12844 · Other software · Icewarp · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record youtu.be youtu.be
Jun 24, 2017Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php fiCVE-2017-9846 · Other software · Magicwinmail · reported by MITREHigh 8.8
Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.
Product
Winmail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record magicwinmail.com github.com
Jan 14, 2017wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com nCVE-2017-5491 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Mar 27, 2015The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive iCVE-2015-2771 · Other software · Websense · reported by MITREMedium 5
The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
Product
Triton AP Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com websense.com
Jun 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTCVE-2012-2591 · Other software · Emailarchitect · reported by cret@cert.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) From or (2) Date field in an email.
Product
Emailarchitect Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Jun 18, 2014Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email.CVE-2012-2592 · Other software · Axigen · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
Product
Axigen Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org exploit-db.com
Jun 5, 2014Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote CVE-2014-3878 · Other software · Ipswitch · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in an add new contact action in the Contacts section or unspecified vectors in (2) an Add Group task in the Contacts section, (3) an add new event action in the Calendar section, or (4) the Task section.
Product
Imail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 12, 2014Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web scriCVE-2013-2585 · Other software · Atmail · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<MessageID>/filenameOriginal/.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record isecauditors.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.