Vulnerabilities

TI-2025-21565 CVE-2025-30236 · GHSA-5p7g-3pf4-fr58

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only…

MEDIUM 43

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00365 Published 2025-03-19 Fixed in 9.4.515 CWE-472

TI-2025-21564 CVE-2025-30235 · GHSA-336g-5q96-rpm6

Race condition in SecurEnvoy SecurAccess

LOW 16

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because con…

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.00219 Published 2025-03-19 Fixed in 9.4.515 CWE-362

TI-2024-24898 CVE-2024-37393 · GHSA-m2cr-jxg8-pr4v

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to…

HIGH 82

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03304 Published 2024-06-10 No fix listed CWE-89

TI-2020-10488 CVE-2020-13376 · GHSA-33rv-x9gp-7cfh

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS…

MEDIUM 45

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.03507 Published 2020-08-07 No fix listed CWE-22

TI-2018-13058 CVE-2018-18466 · GHSA-8wpj-w799-92rg

An issue was discovered in SecurEnvoy SecurAccess 9.3.502.

LOW 31

An issue was discovered in SecurEnvoy SecurAccess 9.3.502.

CVSS 3.0HIGH 7.0 Local Low privileges No interaction EPSS 0.00342 Published 2019-03-18 No fix listed CWE-532

TI-2018-05556 CVE-2018-7707 · GHSA-m9g7-3phh-h6gh

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows…

LOW 32

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02589 Published 2018-03-14 No fix listed CWE-79

TI-2018-05555 CVE-2018-7706 · GHSA-hgfq-cv8m-96hr

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote…

LOW 38

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a ..

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06705 Published 2018-03-14 No fix listed CWE-22

TI-2018-05554 CVE-2018-7705 · GHSA-62f9-ch3r-5chp

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote…

MEDIUM 44

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a ..

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.05985 Published 2018-03-14 No fix listed CWE-22

TI-2018-05553 CVE-2018-7704 · GHSA-h4xx-3pm3-m447

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary…

LOW 36

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04624 Published 2018-03-14 No fix listed CWE-200

TI-2018-05552 CVE-2018-7703 · GHSA-w484-973c-vf96

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows…

LOW 34

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03936 Published 2018-03-14 No fix listed CWE-79

TI-2018-05551 CVE-2018-7702 · GHSA-8mxj-8qfg-pg7x

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of…

MEDIUM 54

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by levera…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.13959 Published 2018-03-14 No fix listed CWE-862

TI-2018-05550 CVE-2018-7701 · GHSA-66fj-rrfw-3jc9

Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before…

LOW 34

Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02905 Published 2018-03-14 No fix listed CWE-352

Vulnerabilities

Filters