Vulnerabilities > Merak > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2005-12-28 | CVE-2005-4556 | Input Validation vulnerability in IceWarp Universal WebMail PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1) lang_settings and (2) language parameters in (a) accounts/inc/include.php and (b) admin/inc/include.php. | 7.5 |
| 2005-05-02 | CVE-2005-0322 | Local Security vulnerability in Mail Server MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 uses weak encryption in the (1) users.cfg, (2) settings.cfg, (3) users.dat or (4) user.dat files, which allows local users to extract the passwords. | 7.2 |
| 2004-10-12 | CVE-2004-1674 | Remote Input Validation vulnerability in IceWarp Web Mail viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arbitrary files via the originalfolder parameter or (2) move arbitrary files via the messageid parameter. | 7.5 |
| 2004-09-10 | CVE-2004-1670 | Remote Input Validation vulnerability in IceWarp Web Mail Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. | 7.5 |
| 2004-08-17 | CVE-2004-1722 | Multiple vulnerability in Merak Mail Server 7.5.2 SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter. | 7.5 |
| 2002-05-29 | CVE-2002-0258 | Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. | 7.5 |