CVE-2021-35299

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

Zammad 日志信息泄露漏洞

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information through email connection configuration probes...

Do you know your OpSec?

Open Source Intelligence OSINT is any information in the public domain that an attacker can dig up about you. Because of that it forms the basis of every Red Team engagement, as threat actor scenarios are created using publicly available information. Bearing that in mind it makes sense to review...

Shopify: A staff member with no permissions can edit Store Customer Email

Impact A staff member with no permissions can edit a store Customer email which they have no access to. This is the email that the store customers will see when emailing them. Details emailSenderConfigurationUpdate is an undocumented GraphQL API that will allows a malicious staff member in a stor...

CVE-2019-19215

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server...

CVE-2019-19806

accountforgotpassword.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses...

Improper Authorization in Jira Server through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Jira Server & Jira Data Center before version 8.3.2, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorizati...

How to configure Email Notifications when using Gmail or Google Apps Mail in Veeam ONE

Challenge You need to configure email notifications to be sent to a Gmail or Google Apps Mail account in Veeam ONE. Cause Use of port 587 is required for TLS when communicating with Gmail or Google Apps Mail. Solution Set the Port to 587 in Veeam ONE console Options Server Settings SMTP Settings...

CVE-2014-2078

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

CVE-2015-8766

Multiple cross-site scripting XSS vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 emailsendmailfromname, 2 emailsendmailfromaddress, 3 emailsmtpfromname, 4 emailsmtpfromaddress, 5...

Open-Xchange (OX) App Suite Email Configuration Information Disclosure Vulnerability

Open-Xchange OX App Suite is prone to an information disclosure vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

PHPYUN最新版任意密码暴力重置(需爆破6位数）

简要描述： PHPYUN最新版任意密码暴力重置 条件为：后台需开启邮件密码找回功能，默认不开启 详细说明： 这个逻辑其实是一个传统的逻辑，首先我们分析一下代码： 条件一： 如果允许用户找回密码操作，phpyun就必须后台配置email或者短信，为了分析方便我们注释掉这一块: 可以确定官网demo是开启了这个配置，因为它允许用户找回密码 wap/forgetpw.class.php: function sendaction $username=yuniconv"utf-8","gbk",$POST'username';...

Syncrify Server <= 3.6 Build 833 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

Syncrify Server 3.6 Build 833 CSRF / Cross Site Scripting

Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/SyncrifyDownload.htm Version: 3.6...

Syncrify Server 3.6 Build 833 - Multiple Vulnerabilities

Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/SyncrifyDownload.htm Version: 3.6...

Open-Xchange Security Advisory 2014-03-17

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 31065 Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.4.1 and 7.4.2 Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.4.1-rev10, 7.4.2-rev...

Multi CSRF vulnerability in DirectAdmin (1.34.4)

Exploit for unknown platform in category web applications ================================================ Multi CSRF vulnerability in DirectAdmin 1.34.4 ================================================ ============================================================================= Title : Multi CS...

DirectAdmin 1.34.4 - Multiple Cross-Site Request Forgerys

DirectAdmin 1.34.4 - Multiple Cross-Site Request Forgerys ============================================================================= Title : Multi CSRF vulnerability in DirectAdmin 1.34.4 Date : 20-3-2010 Version : 1.34.4 Author : K053 K053.Dev0te3 AT gmail Tested on : Ubuntu Vendor :...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:085)

A buffer overflow in the PCX decoder of kimgio was discovered by Bruno Rohee. If an attacker could trick a user into loading a malicious PCX image with any KDE application, he could cause the execution of arbitrary code with the privileges of the user opening the image. The provided packages have...