alinto sogo vulnerabilities, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 5.3CVE-2026-127145EPSS 0.3%
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalen…
- 7.1CVE-2026-127141EPSS 0.3%
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection bu…
- 5.3CVE-2026-127135EPSS 0.2%
SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed …
- 9.1CVE-2026-127131EPSS 0.3%
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attac…
- 7.1CVE-2026-127121EPSS 0.1%
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signa…
- 9.1CVE-2026-127111EPSS 0.3%
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecover…
- 8.7CVE-2026-93453EPSS 0.5%
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password reco…
- 7.1CVE-2026-46446EPSS 0.2%
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- 7.1CVE-2026-46445EPSS 0.2%
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- 2.6CVE-2026-33550EPSS 0.1%
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
- 6.1CVE-2025-71276EPSS 0.1%
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
- 2.1CVE-2026-3054EPSS 0.5%
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and…
- 6.1CVE-2025-63499EPSS 0.3%
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
- 6.1CVE-2025-63498EPSS 0.3%
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
- 6.1CVE-2024-24510EPSS 0.5%
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.
- 6.1CVE-2024-34462EPSS 0.3%
Alinto SOGo through 5.10.0 allows XSS during attachment preview.
- 6.1CVE-2023-48104EPSS 1.0%
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
- 6.1CVE-2022-4558EPSS 0.6%
A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross…
- 6.1CVE-2022-4556EPSS 0.6%
A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipula…
- 8.8CVE-2015-5395EPSS 0.9%
Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
- 6.1CVE-2016-6191EPSS 1.2%
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) T…
- 4.3CVE-2016-6189EPSS 1.4%
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
- 6.1CVE-2014-9905EPSS 1.2%
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
- 6.5CVE-2016-6188EPSS 2.2%
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.