CVE-2019-12924

CRITICAL Year: 2019
CVSS v3 Score
9.8
Critical
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-311
View all →

Vulnerability Description

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all credentials were stored in a cleartext file, it was possible to steal all users' credentials (including the highest privileged users).

Related Vulnerabilities

CVE-2017-9632

CRITICAL
CVSS:9.8(Critical)

A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserW...

CWE-3112017

CVE-2017-9854

CRITICAL
CVSS:9.8(Critical)

An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. Thes...

CWE-3112017

CVE-2018-10698

CRITICAL
CVSS:9.8(Critical)

An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff t...

CWE-3112018

CVE-2018-13992

CRITICAL
CVSS:9.8(Critical)

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default.

CWE-3112018

CVE-2018-17915

CRITICAL
CVSS:9.8(Critical)

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allo...

CWE-3112018

CVE-2018-20100

CRITICAL
CVSS:9.8(Critical)

An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data ...

CWE-3112018