W. Ettlinger

The issue allows an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. This can be achieved through a cross-site request forgery (CSRF) attack. An attacker must already have obtained product administrator or root privileges to exploit this issue.

The issue concerns a critical library in the Trend Micro InterScan Messaging Security Virtual Appliance that may be vulnerable to attack.

The issue concerns the storage of administrative passwords using an outdated hash.

The issue is an information disclosure vulnerability that could allow an attacker to access a specific database and key.

The issue allows an authenticated attacker to abuse the product's web server, granting access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this issue.

The issue is related to an XML External Entity Processing (XXE) vulnerability. This could allow an authenticated administrator to read arbitrary local files. To exploit this, an attacker must already have obtained product administrator or root privileges.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments. This is possible due to missing authentication and authorization. Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote attackers to hijack the authentication of arbitrary users for requests. This can be achieved through multiple cross-site request forgery (CSRF) vulnerabilities. Specifically, attackers can delete e-mail messages via a delete action in a request to "secmail/getmessage.exe" or spoof arbitrary users and reply to their messages via a request to "secserver/securectrl.exe". Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue. As a temporary workaround, consider restricting access to the "secmail/getmessage.exe" and "secserver/securectrl.exe" endpoints to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote authenticated users to read arbitrary e-mail messages. This is achieved via the `option1` parameter in a reply action to "secmail/getmessage.exe" API endpoint. Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote authenticated users to read e-mail messages to arbitrary recipients. This is achieved by using a .. (dot dot) in the `filename` parameter to the "secupload2/upload.aspx" API endpoint. Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue. As a temporary workaround, consider restricting access to the "secupload2/upload.aspx" endpoint or validating the `filename` parameter to prevent directory traversal attacks.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote authenticated users to read arbitrary e-mail messages. This is achieved by using a .. (dot dot) in the `option2` parameter in an attachment action to "secmail/getmessage.exe" API endpoint. Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message. This could potentially lead to unauthorized actions on the affected system. Recommendations: For versions prior to 9.2.501, update to version 9.2.501 or later to resolve the issue.

The issue allows remote attackers to inject arbitrary web script or HTML via a crafted email, which is a result of a cross-site scripting (XSS) vulnerability.

The issue is caused by an integer overflow in the Post Office Agent, which can be exploited by remote attackers to execute arbitrary code. This can be achieved by using a long `username` or `password`, triggering a heap-based buffer overflow.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administrator console. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the `token` parameter to "gwadmin-console/install/login.jsp" or the `PATH INFO` to "gwadmin-console/index.jsp".

The issue allows local users to gain privileges by replacing the content of a specific file with arbitrary shell commands, due to world-writable permissions for /etc/profile.d/vainit.sh.

The issue allows remote authenticated users to inject arbitrary web script or HTML via crafted input. This can be demonstrated by a crafted attribute of an `IMG` element in the `phone` field of a user profile.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `ntpServer` parameter.

The issue allows remote attackers to hijack the authentication of administrators. This can be demonstrated by reconfiguring time settings via a "vaconfig/time" request.

The issue allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a `blob name`. This is due to a directory traversal vulnerability in the email-template feature.