Filtered by vendor Merak Subscriptions
Filtered by product Mail Server Subscriptions

Search

Switch to Advanced Search (Beta)
Total 23 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2004-1670 2 Icewarp, Merak 2 Web Mail, Mail Server 2026-04-16 N/A
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
CVE-2004-1720 1 Merak 1 Mail Server 2026-04-16 N/A
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
CVE-2004-1721 1 Merak 1 Mail Server 2026-04-16 N/A
The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow remote attackers to read arbitrary PHP files via a direct HTTP request to port 32000.