Advisories · Technology
bulwarkmail webmail.
Every CVE that names bulwarkmail webmail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
- bulwarkmail webmail
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery
- bulwarkmail webmail
- CWE-348
- CVSS 5.3 Medium
Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
- bulwarkmail webmail
- Cross-site scripting (XSS)
- CVSS 8.7 High
Bulwark Webmail S/MIME signature verification accepted self-signed certificates
- bulwarkmail webmail
- Weak cryptography or TLS
- CVSS 8.7 High
Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
- bulwarkmail webmail
- Authentication bypass
- CVSS 8.7 High
Bulwark Webmail: Information Exposure: password returned in /api/auth/session
- bulwarkmail webmail
- Information disclosure