Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00559 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00623 · Published 2022-08-25 · No fix listed CWE-79
Priority MEDIUM 45
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01424 · Published 2022-08-25 · No fix listed CWE-74
Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00623 · Published 2022-08-25 · No fix listed CWE-79
Priority MEDIUM 45
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01424 · Published 2022-08-25 · No fix listed CWE-74
Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00623 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00559 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00623 · Published 2022-08-25 · No fix listed CWE-79
Priority LOW 25
An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00493 · Published 2022-05-11 · No fix listed CWE-79
Priority LOW 25
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00493 · Published 2022-05-11 · No fix listed CWE-79
Priority MEDIUM 63
Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05722 · Published 2022-04-05 · No fix listed CWE-91
Priority LOW 37
An issue was discovered in MDaemon before 20.0.4.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02695 · Published 2021-04-14 · No fix listed CWE-610
Priority MEDIUM 41
An issue was discovered in MDaemon before 20.0.4.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01554 · Published 2021-04-14 · No fix listed CWE-74
Priority LOW 39
An issue was discovered in MDaemon before 20.0.4.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0065 · Published 2021-04-14 · No fix listed CWE-352
Priority LOW 29
An issue was discovered in MDaemon before 20.0.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00926 · Published 2021-04-14 · No fix listed CWE-79
Priority LOW 30
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.03229 · Published 2021-02-03 · No fix listed CWE-79
Priority LOW 31
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.03963 · Published 2021-02-03 · No fix listed CWE-79
Priority LOW 25
MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00602 · Published 2019-12-17 · No fix listed CWE-79
Priority MEDIUM 40
MDaemon Webmail (formerly WorldClient) has CSRF.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01039 · Published 2019-07-19 · No fix listed CWE-352
Priority LOW 36
MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01321 · Published 2019-07-16 · No fix listed CWE-20
Priority LOW 29
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00793 · Published 2019-02-21 · No fix listed CWE-79
Priority LOW 29
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00793 · Published 2019-02-21 · No fix listed CWE-79
Priority LOW 26
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expressi…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03232 · Published 2012-08-12 · No fix listed CWE-79
Priority MEDIUM 43
The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted HTTP POST request.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.2279 · Published 2008-06-10 · No fix listed CWE-399
Priority MEDIUM 62
Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.57075 · Published 2008-03-17 · No fix listed CWE-119
THREATIST.IORead the docs