) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:a:mailenable:mailenable:1.2:a:professional:*:*:*:*:*
- CPE Name Search: true
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2015-9279 |
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message. Published: January 16, 2019; 11:29:00 AM -0500 |
V3.0: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2015-9278 |
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request. Published: January 16, 2019; 11:29:00 AM -0500 |
V3.0: 9.8 CRITICAL V2.0: 5.0 MEDIUM |
| CVE-2015-9277 |
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled. Published: January 16, 2019; 11:29:00 AM -0500 |
V3.0: 9.1 CRITICAL V2.0: 7.5 HIGH |
| CVE-2012-0389 |
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter. Published: January 24, 2012; 1:55:01 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2006-1337 |
Buffer overflow in the POP 3 (POP3) service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 allows remote attackers to execute arbitrary code via unknown vectors before authentication. Published: March 20, 2006; 9:06:00 PM -0500 |
V3.x:(not available) V2.0: 7.5 HIGH |