6711 matches found
ALPINE-CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...
CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...
CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host’s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...
VulnCheck KEV: CVE-2017-16651
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default...
Suspicious Metadata Mail Phishing Containing Attachment - ver2
Mail attachment containing a malicious downloader was observed as part of ransomware campaigns. A remote attacker could send spam e-mails including those downloaders and convince users to manually enable them. This would allow the malicious code to run and infect the target system...
Mail.ru: Download attachments with traversal path into any sdcard directory (incomplete fix 106097)
Привет 106097 был исправлен не полностью, все еще можно скачать вложение в письме мимо downloads директории на sdcard. Если имя файла будет что-от вроде "../file.txt" то такой файл будет скачен мимо /sdcard/download. Для файлов "%2e%2e%2f/file.txt" скачивает правильно. Скачать можно только на...
PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
PHPMyFAQ 2.9.8 - Cross-Site Scripting 3 Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability Date: 28-9-2017 Exploit Author: Nikhil Mittal Payatu Labs Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Version: 2.9.8 Tested on: MAC OS CVE :...
PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability Date: 28-9-2017 Exploit Author: Nikhil Mittal Payatu Labs Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Version: 2.9.8 Tested on: MAC OS CVE : 2017-15727 1. Description In phpMyFAQ befo...
Threat Outbreak Alert RuleID31092: Email Messages Distributing Malicious Software on October 27, 2017
Medium Alert ID: 55711 First Published: 2017 October 27 14:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31092 may contain the following files: Name |...
Windows Attachment Manager Incorrect High Risk JAR Handling Vulnerability
The Windows Attachment Manager does not correctly handle JAR files marked as high risk when accessed via Internet Explorer 11. Scenario: The Windows Attachment Manager does not correctly handle JAR files marked as "high risk" when accessed via Internet Explorer 11. This leads to direct execution ...
Redmine cross-site scripting vulnerability (CNVD-2017-31954)
Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . A cross-site scripting vulnerability exists in Redmine versions prior to 3.2.6 and 3.3.x prior to 3.3.3...
[SECURITY] Fedora 25 Update: tnef-1.4.15-1.fc25
This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...
GHSA-M6F7-46HW-GRCJ Creme Fraiche contains OS Command Injection
The setmetadata function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information...
Creme Fraiche contains OS Command Injection
The setmetadata function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information...
Cross site scripting
Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...
CVE-2015-5379
Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...
CVE-2015-5379
Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...
phpMyFAQ cross-site scripting vulnerability (CNVD-2017-33504)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site scripting vulnerability exists in...
phpMyFAQ cross-site request forgery vulnerability (CNVD-2017-33507)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...