Mailessentials

GFI MailEssentials AI versions prior to 22.4 allow authenticated users to enumerate arbitrary directories on the server through the ListServer.IsPathExist() web method, which fails to validate filesystem paths before checking their existence. An attacker with valid credentials can exploit this information disclosure vulnerability to map the server's directory structure and identify sensitive locations. No patch is currently available for this vulnerability.

GFI MailEssentials AI versions before 22.4 expose a file enumeration vulnerability in the ListServer.IsDBExist() web method that allows authenticated users to probe arbitrary filesystem paths and determine file existence on the server. An attacker can exploit this by submitting unrestricted paths via the JSON "path" parameter, which are processed without validation, disclosing sensitive information about the server's filesystem structure. No patch is currently available for this vulnerability.

GFI MailEssentials AI versions before 22.4 contain a stored XSS vulnerability in the Local Domains settings page that allows authenticated users to inject malicious scripts into the txtDescription parameter, which are then executed when administrators view the management interface. An attacker with valid credentials can exploit this to perform actions as a logged-in administrator or steal sensitive information from the management console. No patch is currently available for this vulnerability.

Stored cross-site scripting in GFI MailEssentials AI before version 22.4 allows authenticated users to inject malicious JavaScript through the Spam Keyword Checking interface, which executes when administrators access the management console. An attacker with valid credentials can exploit this to steal session tokens, modify security policies, or perform actions on behalf of logged-in administrators. No patch is currently available for this vulnerability.

GFI MailEssentials AI prior to version 22.4 is vulnerable to stored cross-site scripting in the Spam Keyword Checking interface, where authenticated users can inject malicious scripts that execute when administrators access the management console. An attacker with valid credentials can leverage this to perform actions on behalf of logged-in users or steal session information, affecting organizations using vulnerable versions of the product.

Stored cross-site scripting in GFI MailEssentials AI before version 22.4 allows authenticated users to inject malicious scripts into the Anti-Spoofing configuration page, which execute when administrators view the management interface. An attacker with valid credentials can exploit the TxtSmtpDesc parameter to compromise other authenticated users through arbitrary JavaScript execution. No patch is currently available for this medium-severity vulnerability.

Stored XSS in GFI MailEssentials AI versions before 22.4 allows authenticated users to inject malicious scripts into the Sender Policy Framework Email Exceptions interface that execute when administrators view the management console. An attacker with valid credentials can inject HTML/JavaScript through the email description parameter, compromising other logged-in users' sessions.

GFI MailEssentials AI before version 22.4 contains a stored cross-site scripting vulnerability in the Sender Policy Framework configuration interface that allows authenticated users to inject malicious scripts into IP description fields. An attacker with valid credentials can execute arbitrary JavaScript in the context of administrators accessing the management interface, potentially compromising administrative sessions. No patch is currently available for this vulnerability.

GFI MailEssentials AI prior to version 22.4 allows authenticated users to inject malicious scripts into the URI DNS Blocklist configuration page, which are stored and executed when administrators access the management interface. An attacker with valid credentials can exploit the unsanitized ctl00$ContentPlaceHolder1$pv1$TXB_URIs parameter to perform actions in the context of logged-in users, such as stealing session tokens or modifying security settings. No patch is currently available for this stored cross-site scripting vulnerability.

Stored cross-site scripting in GFI MailEssentials AI versions before 22.4 allows authenticated users to inject malicious scripts into the IP DNS Blocklist configuration page that execute when administrators access the management interface. An attacker with valid credentials can inject HTML/JavaScript through the IP configuration parameter to compromise other authenticated users' sessions. No patch is currently available for this vulnerability.

GFI MailEssentials AI versions before 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page that allows authenticated users to inject malicious scripts into the IP description field, which are executed when administrators view the management interface. An attacker with valid credentials can exploit this to hijack administrator sessions or perform unauthorized actions with their privileges. Currently, no patch is available and the vulnerability requires user interaction to trigger.

GFI MailEssentials AI versions before 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint that allows authenticated users to inject malicious scripts through the POP3 server login field. An attacker with valid credentials can execute arbitrary JavaScript in the context of administrators viewing the management interface, potentially compromising administrative sessions. No patch is currently available for this vulnerability.

GFI MailEssentials AI versions before 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configuration page that allows authenticated users to inject malicious scripts into the management interface. An attacker with valid credentials can execute arbitrary JavaScript in the context of other logged-in administrators by manipulating the description parameter. No patch is currently available for this vulnerability.

GFI MailEssentials AI prior to version 22.4 contains a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint that allows authenticated users to inject malicious JavaScript through the rule name field. When an administrator views the affected rules in the management interface, the stored script executes in their browser session, potentially enabling session hijacking or unauthorized administrative actions. No patch is currently available for this vulnerability.

GFI MailEssentials AI prior to version 22.4 contains a stored XSS vulnerability in the Anti-Spam Whitelist management interface that allows authenticated users to inject malicious scripts through the description field. An attacker with valid credentials can craft payloads that execute in the browser context of other administrators accessing the management console, potentially compromising administrative sessions. No patch is currently available for this vulnerability.

GFI MailEssentials AI prior to version 22.4 contains a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation feature that allows authenticated users to inject malicious scripts into rule names, which are later executed in the browsers of administrators viewing the management interface. An attacker with valid credentials can exploit this to perform actions as a logged-in administrator, including potential unauthorized configuration changes or credential theft. No patch is currently available for this vulnerability.

GFI MailEssentials AI versions before 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation feature that allows authenticated users to inject malicious scripts into rule names, which execute when administrators access the management interface. An attacker with valid credentials can exploit this to perform actions on behalf of logged-in administrators or steal sensitive information from the management dashboard. No patch is currently available for this medium-severity vulnerability.

Stored cross-site scripting in GFI MailEssentials AI versions before 22.4 allows authenticated users to inject malicious JavaScript into the Keyword Filtering rule creation interface, which executes when administrators view the management console. An attacker with valid credentials can compromise other users' sessions and perform unauthorized actions within the MailEssentials application. No patch is currently available for this vulnerability.

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.