CVE-2005-4559

mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout and layout_settings variables when an unrecognized HTTP_USER_AGENT string is provided, which allows remote attackers to access arbitrary files via a request with an unrecognized User Agent that also specifies the desired default_layout and layout_settings parameters.

• http://marc.info/?l=full-disclosure&m=113570229524828&w=2
• http://secunia.com/advisories/17046Patch, Vendor Advisory
• http://secunia.com/advisories/17865
• http://secunia.com/secunia_research/2005-62/advisory/Vendor Advisory
• http://securityreason.com/securityalert/299
• http://securitytracker.com/id?1015412
• http://www.osvdb.org/22082
• http://www.securityfocus.com/archive/1/420255/100/0/threaded
• http://www.securityfocus.com/bid/16069
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23907
• http://marc.info/?l=full-disclosure&m=113570229524828&w=2
• http://secunia.com/advisories/17046Patch, Vendor Advisory
• http://secunia.com/advisories/17865
• http://secunia.com/secunia_research/2005-62/advisory/Vendor Advisory
• http://securityreason.com/securityalert/299
• http://securitytracker.com/id?1015412
• http://www.osvdb.org/22082
• http://www.securityfocus.com/archive/1/420255/100/0/threaded
• http://www.securityfocus.com/bid/16069
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23907

Published

Dec 28, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-4553Buffer overflow in Golden FTP Server 1.92 allows remote atta…
• CVE-2005-4554Multiple SQL injection vulnerabilities in DEV web management…
• CVE-2005-4555Cross-site scripting (XSS) vulnerability in add.php in DEV w…
• CVE-2005-4556PHP remote file include vulnerability in IceWarp Web Mail 5.…
• CVE-2005-4557dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak…
• CVE-2005-4558IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r …
• CVE-2005-4560The Windows Graphical Device Interface library (GDI32.DLL) i…
• CVE-2005-4561Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-4562Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-4563SQL injection vulnerability in main.php in Enterprise Heart …
• CVE-2005-4564The Internet Key Exchange version 1 (IKEv1) implementation i…
• CVE-2005-4565Format string vulnerability in the Internet Key Exchange ver…