IlohaMail versions 0.8.14-rc1 and below allow for unauthenticated remote retrieval of system configuration files.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/35673/ilohamail.txt
Source: https://packetstormsecurity.com/files/35673/ilohamail.txt.html