The vulnerability of the Microsoft Outlook email client for Windows operating systems, related to the possibility of replacing the email address, allows attackers to carry out phishing attacks.

The vulnerability of the Microsoft Outlook email client for Windows operating systems is related to the possibility of replacing the email address. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks by introducing malicious links...

Malicious code in activemodel-email-address_validator (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6462 Malicious code in activemodel-email-address_validator (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-37897 Insufficient access control for password reset in sftpgo

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enable...

GHSA-HW5F-6WVV-XCRH SFTPGo has insufficient access control for password reset

Impact SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions e.g. expired can reset their password and log in. Patches Fixed in v2.6.1...

OPENSUSE-SU-2024:12651-1 perl-Email-Address-1.913-1.1 on GA media

These are all security issues fixed in the perl-Email-Address-1.913-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10452-1 perl-Email-Address-1.908-1.3 on GA media

These are all security issues fixed in the perl-Email-Address-1.908-1.3 package on the GA media of openSUSE Tumbleweed...

python39:3.9 and python39-devel:3.9 security update

An update is available for python-pluggy, module.python-iniconfig, module.python-psycopg2, module.python-more-itertools, module.python3x-pip, module.python3x-setuptools, python-requests, python-psutil, numpy, module.python-ply, module.python-psutil, module.python-pycparser, module.python-cffi,...

Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`

ZendServiceReCaptchaMailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted...

CLSA-2024-1717692229 python3: Fix of 3 CVEs

Remove -b option, use original maintainer approach - Fix expat regression tests for xmletree - CVE-2022-48564: Improve validation of Plist files that prevent DoS - CVE-2023-40217: Fix TLS handshake bypass - CVE-2023-27043: reject malformed addresses in email.parseaddr...

RHEL 7 : perl-email-address (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - perl-Email-Address: denial of service when parsing crafted email address list CVE-2015-7686 -...

CVE-2023-6152

An authentication bypass vulnerability was found in the verifyemailenabled feature of Grafana. Even when enabled, this configuration option does not fully enforce email verification. This issue could allow a remote attacker that has authenticated with basic credentials to change the email address...

Moderate: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

OpenCFP Framework (Sentry) Account takeover via null password reset codes

OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stor...

GHSA-2M5G-8XPW-42VP OpenCFP Framework (Sentry) Account takeover via null password reset codes

OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stor...

RHEL 7 : perl-email-address (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - perl-Email-Address: Specially crafted input could cause Denial of Service due to complex parse method CVE-2018-1255...

Lunary Input Validation Error Vulnerability

lunary is a production toolkit for LLM. An input validation error vulnerability exists in lunary that stems from improper validation of email addresses during the registration process and can be exploited by an attacker to create multiple accounts with the same email address by changing the case ...

Moderate: Red Hat Security Advisory: python3.11 security update

An update for python3.11 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

GitLab < 16.9.6 / 16.10 < 16.10.4 / 16.11 < 16.11.1 (CVE-2024-1347)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain...

CVE-2024-1347

CVE-2024-1347 affects GitLab CE/EE: all versions before 16.9.6, and 16.10 before 16.10.4, and 16.11 before 16.11.1. Under certain conditions, an attacker can bypass domain-based restrictions using a crafted email address. Root cause: insufficient validation of email-based domain restrictions as d...