Gfi
22 CVEs across 12 Gfi products. Browse Gfi vulnerabilities, severities, and proof-of-concept exploits.
Gfi products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23758 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject m… |
CVE-2026-23757 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Re… |
CVE-2026-23756 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized… |
CVE-2026-23753 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is pa… |
CVE-2026-23752 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authentica… |
CVE-2026-2039 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affec… |
CVE-2026-2038 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affect… |
CVE-2026-2037 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-2036 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-23621 | Medium | 4.3 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method expo… |
CVE-2026-23620 | Medium | 4.3 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at… |
CVE-2026-23619 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page. An authenticated user can… |
CVE-2026-23618 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface. A… |
CVE-2026-23617 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An a… |
CVE-2026-23616 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user… |
CVE-2026-23615 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework Email Exceptions interface. An… |
CVE-2026-23614 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework IP Exceptions interface. An aut… |
CVE-2026-23613 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the URI DNS Blocklist configuration page. An authenticated… |
CVE-2026-23612 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page. An authenticated u… |
CVE-2026-23611 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page. An authenticated user can… |
CVE-2026-23610 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint. An authenticated u… |
CVE-2026-23609 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configuration page. An authentic… |
CVE-2026-23608 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint. An authenticate… |
CVE-2026-23607 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interface. An authentica… |
CVE-2026-23606 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow. An a… |
CVE-2026-23605 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation workflow. An authent… |
CVE-2026-23604 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workflow. An authentica… |
CVE-2025-34071 | Critical | 9.8 | 2025-07-02 | A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the f… |
CVE-2025-34070 | Critical | 9.8 | 2025-07-02 | A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged opera… |
CVE-2025-34069 | Critical | 9.8 | 2025-07-02 | An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent se… |
CVE-2025-35940 | High | 8.1 | 2025-06-10 | The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to ac… |
CVE-2025-34491 | High | 8.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sendi… |
CVE-2025-34490 | Medium | 6.5 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP reques… |
CVE-2025-34489 | High | 7.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a… |
CVE-2025-2977 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-2976 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The… |
CVE-2025-2975 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signa… |
CVE-2024-52875 | High | 8.8 | 2025-01-31 | An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.c… |
CVE-2024-11949 | High | 8.8 | 2024-12-12 | GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2024-11948 | Critical | 9.8 | 2024-12-12 | GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
CVE-2024-11947 | High | 8.8 | 2024-12-12 | GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2023-25267 | High | 8.8 | 2023-03-15 | An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0). There is a stack-based Buffer Overflow in the webmail component's 2FASetup functi… |
CVE-2021-29281 | Critical | 9.8 | 2022-07-07 | File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-… |
CVE-2019-16414 | Medium | 6.1 | 2019-09-30 | A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to… |
CVE-2017-7440 | Medium | 6.5 | 2017-05-02 | Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows… |
CVE-2010-5254 | | 2012-09-07 | Untrusted search path vulnerability in GFI Backup 3.1 Build 20100730 2009 Home Edition allows local users to gain privileges via a Trojan horse ArmAccess.dll f… | |
CVE-2010-5181 | High | 7.0 | 2012-08-25 | Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would… |
CVE-2005-3182 | | 2005-10-20 | Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as (1) Host a… | |
CVE-2005-0604 | | 2005-05-02 | lnss.exe in GFI Languard Network Security Scanner 5.0 stores the username and password in memory in plaintext, which could allow local administrators to obtain… | |
CVE-2004-1312 | | 2005-01-03 | A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service… | |
CVE-2002-1121 | | 2002-09-24 | SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default confi… |