49 matches found
GHSA-F7HX-FQXW-RVVJ Insufficient output escaping of attachment names in PHPMailer
Impact CWE-116: Incorrect output escaping. An attachment added like this note the double quote within the attachment name, which is entirely valid: $mail-addAttachment'/tmp/attachment.tmp', 'filename.html";.jpg'; Will result in a message containing these headers: Content-Type:...
Disclosure of issue key validity & issue attachment names in the render api resource - CVE-2019-14995
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check...
Attachment name leakage from restricted space
h3. Issue Summary Hello, This issue was discovered through our bugbounty program and has been verified: User can view attachment names in a restricted space by accessing the following endpoint: noformat http://host/rest/previews/templinksresource/attachmenturl?attachmentId=id noformat h3...
Cisco Email Security Appliance Input Validation Error Vulnerability
Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. An input validation error vulnerability exists in the scanning of attachments in the Cisco ESA, which stems from the program's failure to perform prop...
DEBIAN-CVE-2016-5833
Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834...
WordPress 4.2-4.5.2 - Authenticated Attachment Name Stored XSS
...
Threat Outbreak Alert RuleID16858: Email Messages Distributing Malicious Software on August 17, 2015
Medium Alert ID: 40102 First Published: 2015 July 23 19:14 GMT Last Updated: 2015 August 17 13:15 GMT Version: 7 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16858,...
MailDealer vulnerable to cross-site scripting
Overview MailDealer provided by RAKUS Co.,Ltd. contains a persistent cross-site scripting CWE-79 vulnerability due to a flaw in processing file names of attachments. Keigo YAMAZAKI of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
