Vulnerabilities > Mailenable
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-13 | CVE-2022-42136 | Path Traversal vulnerability in Mailenable Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. | 8.8 |
| 2019-07-08 | CVE-2019-12927 | Cross-site Scripting vulnerability in Mailenable MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. | 6.1 |
| 2019-07-08 | CVE-2019-12926 | Missing Authorization vulnerability in Mailenable MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. | 8.8 |
| 2019-07-08 | CVE-2019-12925 | Path Traversal vulnerability in Mailenable MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. | 8.1 |
| 2019-07-08 | CVE-2019-12924 | Missing Encryption of Sensitive Data vulnerability in Mailenable MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. | 9.8 |
| 2019-07-08 | CVE-2019-12923 | Cross-Site Request Forgery (CSRF) vulnerability in Mailenable In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. | 6.5 |
| 2019-01-16 | CVE-2015-9280 | XXE vulnerability in Mailenable MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter. | 10.0 |
| 2019-01-16 | CVE-2015-9279 | Cross-site Scripting vulnerability in Mailenable MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message. | 6.1 |
| 2019-01-16 | CVE-2015-9278 | Credentials Management vulnerability in Mailenable MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request. | 9.8 |
| 2019-01-16 | CVE-2015-9277 | Path Traversal vulnerability in Mailenable MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. | 9.1 |