CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Mailenable : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2012-0389 79 1 XSS 2012-01-24 2012-02-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.
2 CVE-2010-2580 20 DoS 2010-09-15 2010-09-16
5.0
 None Remote Low Not required None None Partial
The SMTP service (MESMTPC.exe) in MailEnable 3.x and 4.25 does not properly perform a length check, which allows remote attackers to cause a denial of service (crash) via a long (1) email address in the MAIL FROM command, or (2) domain name in the RCPT TO command, which triggers an "unhandled invalid parameter error."
3 CVE-2008-3449 399 DoS 2008-08-04 2008-09-10
5.0
 None Remote Low Not required None None Partial
MailEnable Professional 3.5.2 and Enterprise 3.52 allow remote attackers to cause a denial of service (crash) via multiple IMAP connection requests to the same folder.
4 CVE-2008-1277 20 DoS 2008-03-10 2008-09-05
9.0
 None Remote Low Single system Complete Complete Complete
The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a NULL pointer dereference.
5 CVE-2008-1276 119 1 Exec Code Overflow 2008-03-10 2009-09-01
9.0
 None Remote Low Single system Complete Complete Complete
Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH, (2) EXAMINE, and (3) UNSUBSCRIBE commands.
6 CVE-2008-1275 1 DoS 2008-03-10 2008-09-05
7.8
 None Remote Low Not required None None Complete
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cause a denial of service (crash) via crafted (1) EXPN or (2) VRFY commands.
7 CVE-2007-1301 1 Exec Code Overflow 2007-03-06 2008-09-05
9.0
 Admin Remote Low Single system Complete Complete Complete
Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423.
8 CVE-2007-0955 DoS 2007-02-14 2008-11-15
7.8
 None Remote Low Not required None None Complete
The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (application crash) via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port (143/tcp), which results in an out-of-bounds read.
9 CVE-2007-0652 CSRF 2007-02-15 2008-11-15
5.1
 User Remote High Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in MailEnable Professional before 2.37 allows remote attackers to modify arbitrary configurations and perform unauthorized actions as arbitrary users via a link or IMG tag.
10 CVE-2007-0651 XSS 2007-02-15 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via (1) e-mail messages and (2) the ID parameter to (a) right.asp, (b) Forms/MAI/list.asp, and (c) Forms/VCF/list.asp in mewebmail/base/default/lang/EN/.
11 CVE-2006-6997 287 2007-02-12 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors. NOTE: due to lack of details, it is not clear whether this is the same as CVE-2006-1792.
12 CVE-2006-6964 +Info 2007-01-29 2008-09-05
4.0
 None Remote Low Single system Partial None None
MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source.
13 CVE-2006-6605 Exec Code Overflow 2006-12-19 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the POP service in MailEnable Standard 1.98 and earlier; Professional 1.84, and 2.35 and earlier; and Enterprise 1.41, and 2.35 and earlier before ME-10026 allows remote attackers to execute arbitrary code via a long argument to the PASS command.
14 CVE-2006-6484 DoS 2006-12-12 2008-09-05
5.0
 None Remote Low Not required None None Partial
The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer dereference, as addressed by the ME-10023 hotfix, and a different issue than CVE-2006-6423. NOTE: some details were obtained from third party information.
15 CVE-2006-6423 Exec Code Overflow 2006-12-11 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.
16 CVE-2006-6291 119 DoS Overflow 2006-12-05 2011-08-04
6.8
 None Remote Low Single system None None Complete
Stack overflow in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service (crash) via a long argument containing * (asterisk) and ? (question mark) characters to the DELETE command, as addressed by the ME-10020 hotfix.
17 CVE-2006-6290 DoS Exec Code Overflow 2006-12-05 2008-09-05
6.5
 User Remote Low Single system Partial Partial Partial
Multiple stack-based buffer overflows in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.82 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.30 and 2.0 through 2.33 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a long argument to the (1) EXAMINE or (2) SELECT command.
18 CVE-2006-6239 255 2006-12-03 2011-03-10
7.5
 User Remote Low Not required Partial Partial Partial
webadmin in MailEnable NetWebAdmin Professional 2.32 and Enterprise 2.32 allows remote attackers to authenticate using an empty password.
19 CVE-2006-5177 119 DoS Exec Code Overflow 2006-10-10 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitrary code via unspecified vectors involving crafted base64 encoded NTLM Type 3 messages, or (2) cause a denial of service via crafted base64 encoded NTLM Type 1 messages, which trigger a buffer over-read.
20 CVE-2006-5176 119 Exec Code Overflow 2006-10-10 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Buffer overflow in NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to execute arbitrary code via "the signature field of NTLM Type 1 messages".
21 CVE-2006-4616 DoS 2006-09-06 2008-09-05
5.0
 None Remote Low Not required None None Partial
SMTP service in MailEnable Standard, Professional, and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records, which triggers a null pointer exception.
22 CVE-2006-3277 399 DoS 2006-06-28 2011-03-17
5.0
 None Remote Low Not required None None Partial
The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument, possibly triggering a length inconsistency or a missing argument.
23 CVE-2006-1792 2006-04-15 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22 has unknown attack vectors and impact related to "authentication exploits". NOTE: this is a different set of affected versions, and probably a different vulnerability than CVE-2006-1337.
24 CVE-2006-1338 399 DoS 2006-03-20 2011-03-09
5.0
 None Remote Low Not required None None Partial
Webmail in MailEnable Professional Edition before 1.73 and Enterprise Edition before 1.21 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors involving "incorrectly encoded quoted-printable emails".
25 CVE-2006-1337 119 Exec Code Overflow 2006-03-20 2011-04-07
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the POP 3 (POP3) service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 allows remote attackers to execute arbitrary code via unknown vectors before authentication.
26 CVE-2006-0504 DoS 2006-02-01 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing "formatted quoted-printable emails" via webmail.
27 CVE-2006-0503 DoS 2006-02-01 2008-09-05
5.0
 None Remote Low Not required None None Partial
IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.
28 CVE-2005-4457 DoS Exec Code 2005-12-21 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
MailEnable Enterprise 1.1 before patch ME-10009 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via several "..." (triple dot) sequences in a UID FETCH command.
29 CVE-2005-4456 DoS Exec Code Overflow 2005-12-21 2008-09-05
7.8
 None Remote Low Not required None None Complete
Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) LIST, (2) LSUB, and (3) UID FETCH commands. NOTE: it is possible that these are alternate vectors for the issue described in CVE-2005-4402.
30 CVE-2005-4402 Exec Code Overflow 2005-12-20 2008-09-05
6.5
 User Remote Low Single system Partial Partial Partial
Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command.
31 CVE-2005-3993 DoS 2005-12-04 2008-09-05
7.8
 None Remote Low Not required None None Complete
Multiple unspecified vulnerabilities in MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allow attackers to cause a denial of service (crash) via invalid IMAP commands.
32 CVE-2005-3813 DoS 2005-11-25 2008-09-05
4.0
 None Remote Low Single system None None Partial
IMAP service (meimaps.exe) of MailEnable Professional 1.7 and Enterprise 1.1 allows remote authenticated attackers to cause a denial of service (application crash) by using RENAME with a non-existent mailbox, a different vulnerability than CVE-2005-3690.
33 CVE-2005-3691 Dir. Trav. 2005-11-18 2008-09-05
5.0
 None Remote Low Not required None Partial None
Directory traversal vulnerability in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to create or rename arbitrary mail directories via the mailbox name argument of the (1) create or (2) rename commands.
34 CVE-2005-3690 Exec Code Overflow 2005-11-18 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to execute arbitrary code via a long mailbox name in the (1) select, (2) create, (3) delete, (4) rename, (5) subscribe, or (6) unsubscribe commands.
35 CVE-2005-3155 Exec Code Overflow 2005-10-05 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the W3C logging for MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code.
36 CVE-2005-2278 Exec Code Overflow 2005-07-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrary code via the status command with a long mailbox name.
37 CVE-2005-2223 DoS 2005-07-12 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in the SMTP service in MailEnable Standard before 1.9 and Professional before 1.6 allows remote attackers to cause a denial of service (crash) during authentication.
38 CVE-2005-2222 2005-07-12 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unknown vulnerability in the HTTPMail service in MailEnable Professional before 1.6 has unknown impact and attack vectors.
39 CVE-2005-1781 DoS 2005-05-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in SMTP authentication for MailEnable allows remote attackers to cause a denial of service (crash).
40 CVE-2005-1348 Exec Code Overflow 2005-05-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
41 CVE-2005-1015 Exec Code Overflow 2005-05-02 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in MailEnable Imapd (MEIMAP.exe) allows remote attackers to execute arbitrary code via a long LOGIN command.
42 CVE-2005-1014 Exec Code Overflow 2005-05-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the IMAP service for MailEnable Enterprise 1.04 and earlier and Professional 1.54 allows remote attackers to execute arbitrary code via a long AUTHENTICATE command.
43 CVE-2005-1013 DoS 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None None Partial
The SMTP service in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to cause a denial of service (server crash) via an EHLO command with a Unicode string.
44 CVE-2005-0804 DoS 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None None Partial
Format string vulnerability in MailEnable 1.8 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the mailto field.
45 CVE-2004-2727 119 DoS Overflow 2004-12-31 2008-09-05
4.3
 None Remote Medium Not required None None Partial
Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.
46 CVE-2004-2726 DoS 2004-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.
47 CVE-2004-2501 Exec Code Overflow 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute arbitrary code via (1) a long command string or (2) a long string to the MEIMAP service and then terminating the connection.
48 CVE-2004-2194 DoS 2004-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) via malformed (1) SMTP or (2) IMAP commands.
49 CVE-2002-2357 119 DoS Overflow 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow.
Total number of vulnerabilities : 49   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.