Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 47

Export CSV
CVE-2020-25850

HGiga MailSherlock - Arbitrary File Download

The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Hgiga
Products
Msr45 Isherlock-user Ssr45 Isherlock-user
CVE-2020-10512

HGiga C&Cmail - SQL Injection

HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Hgiga
Products
Oaklouds Ccm\@il
CVE-2020-10511

HGiga C&Cmail - Broken Access Control

HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Hgiga
Products
Oaklouds Ccm\@il
CVE-2019-9883

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hgiga
Products
Msr35 Isherlock-base Msr35 Isherlock-sysinfo Msr35 Isherlock-user and 5 more
CVE-2019-9882

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hgiga
Products
Msr35 Isherlock-base Msr35 Isherlock-sysinfo Msr35 Isherlock-user and 5 more
CVE-2018-17542

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.

CVSS 3.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Hgiga
Products
Oaklouds Mailsherlock