6 results · Clear filters · Feed
-
Medium 4.3
SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attack…
-
Medium 6.5
SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMA…
-
Medium 4.3
SOGo before 5.12.13 Sieve Script Injection via Notification Address
SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or di…
-
Medium 6.5
SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an imperson…
-
Medium 6.4
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
-
Medium 4.3
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The …