Mailscanner is a narrowly scoped open-source email filtering and security gateway deployed across mail server infrastructure, where its disclosures concentrate in a single product line and recur through weakness classes tied to file handling and input validation, including symlink following, path traversal, and improper pathname restriction. The vulnerability profile reflects the exposed position of email gateways and their need to safely parse and process untrusted message content and attachments, while public exploit code has a moderate tendency to emerge for vulnerabilities in this product. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mailscanner over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-5991HIGH Directory traversal vulnerability in docs.php in MailWatch for MailScanner 1.0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) | Jan 28, 2009 | 7.5 | 30 | NO | YES |
CVE-2008-5313MEDIUM mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot-a | Dec 3, 2008 | 6.9 | 21 | NO | NO |
CVE-2010-3293MEDIUM mailscanner can allow local users to prevent virus signatures from being updated | Oct 28, 2019 | 5.5 | 20 | NO | NO |
CVE-2010-3292MEDIUM The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could a | Nov 12, 2019 | 5.5 | 19 | NO | NO |
CVE-2005-3470HIGH SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands. | Nov 2, 2005 | 7.5 | 19 | NO | NO |
CVE-2005-1706HIGH Unknown vulnerability in MailScanner 4.41.3 and earlier, related to "incomplete reporting of viruses in zip files," allows remote attackers to bypass virus detection. | May 24, 2005 | 7.5 | 19 | NO | NO |
CVE-2010-3095MEDIUM mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists because of an incomplet | Nov 12, 2019 | 4.7 | 18 | NO | NO |
CVE-2008-5312MEDIUM mailscanner 4.55.10 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot- | Dec 3, 2008 | 6.9 | 18 | NO | NO |
CVE-2002-2228MEDIUM MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with (1) extra leading spaces, (2) extra trailing spaces, | Dec 31, 2002 | 6.4 | 17 | NO | NO |
CVE-2005-3471MEDIUM Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files. | Nov 2, 2005 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mailscanner.
Media articles that mention a CVE ID that affects a product developed by Mailscanner — matched by CVE ID, not by vendor name.