Vulnerabilities > Mailenable

DATE CVE VULNERABILITY TITLE RISK
2019-07-08 CVE-2019-12927 Cross-Site Scripting vulnerability in Mailenable
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks.
network
mailenable CWE-79
4.3
2019-07-08 CVE-2019-12926 Missing Authorization vulnerability in Mailenable
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas.
network
low complexity
mailenable CWE-862
6.5
2019-07-08 CVE-2019-12925 Path Traversal vulnerability in Mailenable
MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user.
network
low complexity
mailenable CWE-22
6.5
2019-07-08 CVE-2019-12924 Missing Encryption of Sensitive Data vulnerability in Mailenable
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user.
network
low complexity
mailenable CWE-311
5.0
2019-07-08 CVE-2019-12923 Cross-Site Request Forgery (CSRF) vulnerability in Mailenable
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request.
4.3
2019-01-16 CVE-2015-9280 XXE vulnerability in Mailenable
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
network
low complexity
mailenable CWE-611
5.0
2019-01-16 CVE-2015-9279 Cross-Site Scripting vulnerability in Mailenable
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
network
mailenable CWE-79
4.3
2019-01-16 CVE-2015-9278 Credentials Management vulnerability in Mailenable
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
network
low complexity
mailenable CWE-255
5.0
2019-01-16 CVE-2015-9277 Path Traversal vulnerability in Mailenable
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/..
network
low complexity
mailenable CWE-22
7.5
2014-09-19 CVE-2012-2588 Cross-Site Scripting vulnerability in Mailenable 6.5
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.
network
mailenable CWE-79
4.3