彙總 altn 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本、CSRF、緩衝區溢位與輸入驗證問題，在 軟體部署與生產負載 使用場景中可能帶來 工作階段劫持、應用程式崩潰與記憶體損壞 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2022-37238 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter. | [email protected] | 5.4 | 0.46% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37245 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint. | [email protected] | 5.4 | 0.55% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37244 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection. | [email protected] | 5.4 | 0.46% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37243 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint. | [email protected] | 5.4 | 0.55% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37242 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter. | [email protected] | 9.8 | 1.16% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37241 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint. | [email protected] | 5.4 | 0.55% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37240 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter. | [email protected] | 9.8 | 1.16% | 2022-08-25 | 2026-06-17 |
| CVE-2022-37239 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint. | [email protected] | 5.4 | 0.55% | 2022-08-25 | 2026-06-17 |
| CVE-2022-29976 | An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . | [email protected] | 5.4 | 0.46% | 2022-05-11 | 2026-06-17 |
| CVE-2022-29975 | An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . | [email protected] | 5.4 | 0.46% | 2022-05-11 | 2026-06-17 |
| CVE-2022-25356 | Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. | [email protected] | 5.3 | 5.88% | 2022-04-04 | 2026-06-17 |
| CVE-2021-27183 | An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution. | [email protected] | 7.2 | 2.70% | 2021-04-14 | 2026-06-16 |
| CVE-2021-27182 | An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. | [email protected] | 8.8 | 1.55% | 2021-04-14 | 2026-06-16 |
| CVE-2021-27181 | An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user. | [email protected] | 8.8 | 0.65% | 2021-04-14 | 2026-06-16 |
| CVE-2021-27180 | An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user. | [email protected] | 6.1 | 0.93% | 2021-04-14 | 2026-06-16 |
| CVE-2020-18724 | Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list. | [email protected] | 5.4 | 3.19% | 2021-02-03 | 2026-06-16 |
| CVE-2020-18723 | Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities. | [email protected] | 5.4 | 3.80% | 2021-02-03 | 2026-06-16 |
| CVE-2019-19497 | MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message. | [email protected] | 5.4 | 0.60% | 2019-12-17 | 2026-06-16 |
| CVE-2018-17792 | MDaemon Webmail (formerly WorldClient) has CSRF. | [email protected] | 8.8 | 1.04% | 2019-07-19 | 2026-06-16 |
| CVE-2019-13612 | MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious e-mail, if a customer deploys a server with sufficient resources to scan large messages. | [email protected] | 7.5 | 1.32% | 2019-07-16 | 2026-06-16 |