GFI Software

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations.

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature.

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service.

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue.

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.

An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0).

The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key.

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue.

A vulnerability was found in GFI KerioConnect 10.0.6.

A vulnerability was found in GFI KerioConnect 10.0.6.

A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic.

GFI Archiver Telerik Web UI Remote Code Execution Vulnerability.

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability.

GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability.

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Ex…

File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.

GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability.

GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability.

SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other produc…

GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.

GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as (1) Host and (2) Accept in HTTP requests.

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler.

Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signatur…

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler.