Filtered by vendor Afterlogic Subscriptions
Total 12 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-43176 1 Afterlogic 1 Aurora Files 2024-11-21 8.8 High
A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.
CVE-2021-26294 1 Afterlogic 2 Aurora, Webmail Pro 2024-11-21 7.5 High
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
CVE-2021-26293 1 Afterlogic 2 Aurora, Webmail Pro 2024-11-21 9.8 Critical
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
CVE-2019-19129 1 Afterlogic 2 Aurora, Webmail Pro 2024-11-21 6.1 Medium
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
CVE-2019-16238 1 Afterlogic 1 Aurora 2024-11-21 6.1 Medium
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
CVE-2017-14597 1 Afterlogic 2 Aurora, Webmail 2024-11-21 N/A
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.
CVE-2012-2587 1 Afterlogic 1 Mailsuite Pro 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.
CVE-2009-4743 1 Afterlogic 1 Webmail Pro 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName and (2) HistoryKey parameters.
CVE-2008-0631 1 Afterlogic 1 Mailbee Objects 2024-11-21 N/A
Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files via the SaveToDisk method, or (2) modify files via the AddStringToFile method.
CVE-2008-0333 1 Afterlogic 1 Mailbee Webmail Pro 2024-11-21 N/A
Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the temp_filename parameter.
CVE-2007-5290 1 Afterlogic 1 Mailbee Webmail 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.
CVE-2007-2061 1 Afterlogic 1 Mailbee Webmail 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail Pro 3.4 allows remote attackers to inject arbitrary web script or HTML via the username parameter.