Gfi vulnerabilitiesNone on the known-exploited list.
Gfi has 22 published vulnerabilities across 12 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Kerio Control, with 5. If you run Gfi software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Gfi products have the most vulnerabilities?
Kerio Control leads with 5 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Gfi vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Gfi's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Gfi flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 29%CVE-2024-52875High
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.
- 6.7%CVE-2002-1121High
SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other...
- 4.0%CVE-2005-3182High
Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as (1) Host and (2) Accept in HTTP requests.
- 2.6%CVE-2021-29281Critical
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.
- 2.5%CVE-2004-1312Critical
A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials...
- 1.6%CVE-2019-16414Medium
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
- 1.4%CVE-2024-11948Critical
GFI Archiver Telerik Web UI Remote Code Execution Vulnerability.
- 1.0%CVE-2023-25267High
An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0).
- 0.9%CVE-2025-34491High
GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue.
- 0.9%CVE-2017-7440Medium
Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a...
All Gfi products we track.
11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Kerio Controlkerio_control5 vulnerabilities7 versions
- Archiverarchiver4 vulnerabilities12 versions
- Kerio Connectkerio_connect4 vulnerabilities67 versions
- Mailessentialsmailessentials4 vulnerabilities16 versions
- Mailsecuritymailsecurity3 vulnerabilities3 versions
- Gfi Backup 2009gfi_backup_20091 vulnerability1 version
- Languard Network Security Scannerlanguard_network_security_scanner1 vulnerability1 version
- Vipre Antivirusvipre_antivirus1 vulnerability1 version
- Gfi Languardgfi_languard0 vulnerabilities1 version
- Gfi Languard Reportpackgfi_languard_reportpack0 vulnerabilities1 version
- Gfi Reportcenter Frameworkgfi_reportcenter_framework0 vulnerabilities1 version
This directory lists the 11 Gfi products with at least one tracked version, of 12 in our catalogue.
Running Gfi? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
- Matched to
- Kerio Control on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 22 published vulnerabilities across 12 products and 111 versions from Gfi.
None of Gfi's vulnerabilities is on the list of flaws known to be exploited today.
Kerio Control, with 5 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Gfi products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.