7 vulnerabilities have been found in Neon WebMail for Java. When exploited, these vulnerabilities allow executing of arbitrary JSP code, escalation of user’s privileges, manipulating of user’s emails and user account information, disclosure of files on the server, and potentially cause a DoS via large CPU resource utilization by the MySQL server.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/50331/NeonWebMail.txt
Source: https://packetstormsecurity.com/files/50331/NeonWebMail.txt.html