IceWarp

Records73All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

IceWarp records in CISA KEV

No IceWarp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Web Mail 25 records MEDIUM Mail Server 19 records HIGH Webclient 10 records MEDIUM Icewarp 6 records MEDIUM Email Server 3 records LOW Merak Mail Server 3 records LOW Webmail Server 3 records LOW Icewarp Server 2 records MEDIUM

Records

19 records in Mail Server · all components

TI-2023-20749 CVE-2023-39699 · GHSA-w395-jm45-w9cj

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI)…

HIGH 82

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01408 Published 2023-08-24 No fix listed CWE-22

TI-2015-01363 CVE-2015-1503 · GHSA-xq74-7v9v-c3c9

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow…

HIGH 66

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) ..

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.57007 Published 2018-05-08 No fix listed CWE-22

TI-2019-09404 CVE-2019-12593 · GHSA-46v5-x5rw-m988

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via…

MEDIUM 61

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.40965 Published 2019-06-03 No fix listed CWE-22

TI-2021-14809 CVE-2021-36580 · GHSA-5q6m-32cq-4f86

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2…

MEDIUM 60

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01588 Published 2023-07-27 No fix listed CWE-601

TI-2020-11018 CVE-2020-14066 · GHSA-3jh7-385x-jfrq

IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are…

MEDIUM 42

IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01774 Published 2020-07-15 No fix listed CWE-434

TI-2011-03155 CVE-2011-3579 · GHSA-7pr7-2x33-78rj

server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote…

LOW 36

server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.04784 Published 2011-09-30 No fix listed CWE-399

TI-2020-17019 CVE-2020-27982 · GHSA-94pj-vmh2-v666

IceWarp 11.4.5.0 allows XSS via the language parameter.

LOW 35

IceWarp 11.4.5.0 allows XSS via the language parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.05342 Published 2020-11-09 No fix listed CWE-79

TI-2020-11017 CVE-2020-14065 · GHSA-qm53-rcwv-78qc

IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.

LOW 32

IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01462 Published 2020-07-15 No fix listed CWE-434

TI-2020-11016 CVE-2020-14064 · GHSA-2rxj-7r53-f46w

IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.

LOW 31

IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00969 Published 2020-07-15 No fix listed CWE-668

TI-2023-20750 CVE-2023-39700 · GHSA-953m-vr4v-6m4x

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting…

LOW 30

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0148 Published 2023-08-24 No fix listed CWE-79

TI-2019-13888 CVE-2019-19265 · GHSA-f852-fx4g-rhjq

IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions)…

LOW 29

IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01011 Published 2020-01-06 No fix listed CWE-79

TI-2018-11690 CVE-2018-16324 · GHSA-2vp6-jrqg-75vc

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.

LOW 29

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01058 Published 2018-09-01 No fix listed CWE-79

TI-2018-05388 CVE-2018-7475 · GHSA-4h3x-f92m-43fv

Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server…

LOW 29

Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00947 Published 2018-06-30 No fix listed CWE-79

TI-2019-13889 CVE-2019-19266 · GHSA-rr8g-54q6-hvmm

IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions)…

LOW 26

IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00722 Published 2020-01-06 No fix listed CWE-79

TI-2011-03156 CVE-2011-3580 · GHSA-gw57-jqq2-qw5f

IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain…

LOW 26

IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0161 Published 2011-09-30 No fix listed CWE-200

TI-2025-27101 CVE-2025-40630 · GHSA-hf55-g8pm-mm27

Open redirect in Icewarp Mail Server

LOW 24

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00496 Published 2025-05-16 No fix listed CWE-601

TI-2017-09511 CVE-2017-12844 · GHSA-qxp8-4ggh-j3rg

Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4…

LOW 23

Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00784 Published 2017-08-23 No fix listed CWE-79

TI-2025-27103 CVE-2025-40632 · GHSA-qxgw-cmmh-8chh

Cross-site scripting (XSS) vulnerability in IceWarp Mail Server

LOW 10

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0.

CVSS 4.0LOW 2.0 Adjacent network No auth User interaction EPSS 0.00224 Published 2025-05-16 No fix listed CWE-79

TI-2025-27102 CVE-2025-40631 · GHSA-77wj-x762-6p2r

HTTP host header injection vulnerability in IceWarp Mail Server

LOW 10

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0.

CVSS 4.0LOW 2.0 Adjacent network No auth User interaction EPSS 0.00224 Published 2025-05-16 No fix listed CWE-644

Open these records in search →