Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Openfind Component: Mailgates Clear all filters
TI-2024-06246 CVE-2024-6739 · GHSA-pvxg-5348-rxvf

Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag

Priority LOW 28

The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00447 Published 2024-07-15 Fixed in V6.0 6.1.7.040 CWE-1004
TI-2020-15840 CVE-2020-25849 · GHSA-8wvc-vg4w-745v

Openfind MailGates/MailAudit - Command Injection

Priority MEDIUM 42

MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02231 Published 2020-11-01 No fix listed CWE-78
TI-2020-10167 CVE-2020-12782 · GHSA-78mw-xr47-g4hm

Openfind MailGates - Command Injection

Priority MEDIUM 46

Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and gain unauthorized access to system files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01886 Published 2020-06-23 No fix listed CWE-77