CVE-2015-1503

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.

• CWE-22

• http://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44587/Exploit, Third Party Advisory, VDB Entry
• https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44587/Exploit, Third Party Advisory, VDB Entry
• https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614Exploit, Third Party Advisory

Published

May 8, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1496Motorola Scanner SDK uses weak permissions for (1) CoreScann…
• CVE-2015-1497radexecd.exe in Persistent Systems Radia Client Automation (…
• CVE-2015-1498Persistent Systems Radia Client Automation does not properly…
• CVE-2015-1499The ActiveMQ Broker in Samsung Security Manager (SSM) before…
• CVE-2015-1500Multiple stack-based buffer overflows in the TSUnicodeGraphE…
• CVE-2015-1501The factory.loadExtensionFactory function in TSUnicodeGraphE…
• CVE-2015-1512Multiple cross-site scripting (XSS) vulnerabilities in Fancy…
• CVE-2015-1513SQL injection vulnerability in SIPhone Enterprise PBX allows…
• CVE-2015-1514Multiple SQL injection vulnerabilities in FancyFon FAMOC bef…
• CVE-2015-1515The dwall.sys driver in SoftSphere DefenseWall Personal Fire…
• CVE-2015-1516Cross-site scripting (XSS) vulnerability in Polycom RealPres…
• CVE-2015-1517SQL injection vulnerability in Piwigo before 2.7.4, when all…