Ipswitch: Security Vulnerabilities
Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other users.
CVSS Score
7.5
EPSS Score
0.007
Published
2001-10-12
Directory traversal vulnerability in readmail.cgi for Ipswitch IMail 7.04 and earlier allows remote attackers to access the mailboxes of other users via a .. (dot dot) in the mbx parameter.
CVSS Score
5.0
EPSS Score
0.007
Published
2001-10-12
Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control.
CVSS Score
7.5
EPSS Score
0.007
Published
2001-10-12
Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS Score
7.5
EPSS Score
0.063
Published
2001-10-12
Buffer overflow in IPSwitch IMail SMTP server 6.06 and possibly prior versions allows remote attackers to execute arbitrary code via a long From: header.
CVSS Score
7.5
EPSS Score
0.006
Published
2001-06-27
IPSwitch IMail 6.0.5 allows remote attackers to cause a denial of service using the SMTP AUTH command by sending a base64-encoded user password whose length is between 80 and 136 bytes.
CVSS Score
5.0
EPSS Score
0.002
Published
2001-02-16
Ipswitch Imail 6.0 allows remote attackers to cause a denial of service via a large number of connections in which a long Host: header is sent, which causes a thread to crash.
CVSS Score
5.0
EPSS Score
0.101
Published
2000-11-14
WinCOM LPD 1.00.90 allows remote attackers to cause a denial of service via a large number of LPD options to the LPD port (515).
CVSS Score
5.0
EPSS Score
0.099
Published
2000-11-14
The web server in IPSWITCH IMail 6.04 and earlier allows remote attackers to read and delete arbitrary files via a .. (dot dot) attack.
CVSS Score
6.4
EPSS Score
0.021
Published
2000-10-20
Ipswitch IMAIL server 6.02 and earlier allows remote attackers to cause a denial of service via the AUTH CRAM-MD5 command.
CVSS Score
5.0
EPSS Score
0.016
Published
2000-04-06