| CVE-2020-14064 | MEDIO6.5 | IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts. | 15/07/2020 |
| CVE-2020-8512 | MEDIO6.1 | In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. | 01/02/2020 |
| CVE-2019-19265 | MEDIO6.1 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts. | 06/01/2020 |
| CVE-2019-19266 | MEDIO5.4 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects. | 06/01/2020 |
| CVE-2010-5340 | MEDIO6.1 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0. | 11/10/2019 |
| CVE-2010-5339 | MEDIO6.1 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0. | 11/10/2019 |
| CVE-2010-5338 | MEDIO6.1 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0. | 11/10/2019 |
| CVE-2010-5337 | MEDIO6.1 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0. | 11/10/2019 |
| CVE-2010-5336 | MEDIO6.1 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0. | 11/10/2019 |
| CVE-2010-5335 | ALTO7.5 | IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php) is not properly sanitised and can therefore be exploited to browse the partitio | 11/10/2019 |
| CVE-2010-5334 | ALTO7.5 | IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not properly sanitised and can therefore be exploited to browse the partition where IceWa | 11/10/2019 |
| CVE-2019-12593 | ALTO7.5 | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. | 03/06/2019 |
| CVE-2018-16324 | MEDIO6.1 | In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field. | 01/09/2018 |
| CVE-2018-7475 | MEDIO6.1 | Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML. | 30/06/2018 |
| CVE-2015-1503 | ALTO7.5 | Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar | 08/05/2018 |
| CVE-2017-7855 | MEDIO6.1 | In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter. | 31/08/2017 |
| CVE-2017-12844 | MEDIO4.8 | Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name. | 23/08/2017 |
| CVE-2011-3580 | MEDIO5.0 | IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function. | 30/09/2011 |
| CVE-2011-3579 | MEDIO6.4 | server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference. | 30/09/2011 |
| CVE-2009-1469 | MEDIO4.3 | CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as d | 05/05/2009 |