CVE-2018-17542

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
OAKlouds	MailSherlock	>= unspecified, < 1.5.235

References

https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73Third Party Advisory
https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=28Third Party Advisory
https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73Third Party Advisory
https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=28Third Party Advisory

Timeline

Published: Feb 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17555.9IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being CVE-2018-175529.8SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.CVE-2018-175538.8An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allo CVE-2018-175557.5The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids paramete CVE-2018-175565.4MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.CVE-2018-175589.8Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18 CVE-2018-175597.5Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.CVE-2018-17567.5IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-c CVE-2018-175606.1The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versio CVE-2018-175627.5Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying datab CVE-2018-175635.3A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's CVE-2018-175649.8A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration paramet