[SECURITY] Fedora 34 Update: libspf2-1.2.11-1.20210922git4915c308.fc34

libspf2 is an implementation of the SPF Sender Policy Framework specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is...

[SECURITY] Fedora 33 Update: libspf2-1.2.11-1.20210922git4915c308.fc33

libspf2 is an implementation of the SPF Sender Policy Framework specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is...

Sifchain: Vulnerability : Email Spoofing

Hi Team Hope you are doing well. I found vulnerability. Issue: Email Spoofing I just sent a forged email to [email protected] that appears to originate from [email protected] I was able to do this because of SPF Soft Fail and I could not find DMARC record of this domain. SPF record...

Email Subscribers & Newsletters Plugin for WordPress < 4.5.6 Email Forgery/Spoofing Vulnerability

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by an email forgery/spoofing vulnerability in the class-es-newsletters.php class due to missing authentication for a critical function. An unauthenticated, remote attacker can exploit this via a speciall...

WordPress Plugin 'Email Subscribers & Newsletters' < 4.5.6 Email Forgery/Spoofing Vulnerability.

The WordPress application running on the remote host has a version of the 'Email Subscribers & Newsletters' plugin that is affected by an email forgery/spoofing vulnerability in the class-es-newsletters.php class due to missing authentication for a critical function. An unauthenticated, remote...

CVE-2020-5780

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing...

CVE-2020-5780

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing...

Design/Logic Flaw

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing...

CVE-2020-5780

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing...

CVE-2020-5780

The CVE-2020-5780 entry concerns the WordPress plugin Icegram Email Subscribers & Newsletters. Affected version(s) are prior to 4.5.6, where a vulnerability in the class-es-newsletters.php allows an unauthenticated, remote attacker to forge/spoof emails via an unauthenticated AJAX request to an a...

Email Subscribers & Newsletters < 4.5.6 - Unauthenticated email forgery/spoofing

It allows a remote unauthenticated attacker to send forged emails to all recipients from the available lists of contacts or subscribers, with complete control over the content and subject of the email. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com Content-Type:...

WordPress Email Subscribers & Newsletters plugin <= 4.5.5 - Unauthenticated email forgery/spoofing vulnerability

Unauthenticated email forgery/spoofing vulnerability found by Alex Peña in WordPress Email Subscribers & Newsletters plugin versions = 4.5.5. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.5.6...

Mozilla Thunderbird S/MIME Signature Spoofing Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation of a set of independent from MozillaApplicationSuite e-mail client software. The software supports IMAP and POP mail protocols as well as HTML mail format. A security vulnerability exists in versions of Mozilla Thunderbird prior to 60.5....

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

Gratipay: Email Spoofing

Hey Gratipay, It appears that spoofed email can be sent from 1 of your emails. The following email is vulnerable: [email protected] Information Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source...

Vanilla Forums Password Reset Vulnerability

Vanilla Forums is a Canadian company Vanilla Forums PHP-based open source forum program . A security vulnerability exists in the from method of the library/core/class.email.php file in versions of Vanilla Forums prior to 2.3.1. A remote attacker can exploit this vulnerability by using a specially...

Amazon Users Targets of Massive Locky Ransomware Spam Campaign

Amazon customers were targeted in a massive spear phishing campaign where recipients received Microsoft Word documents with a macro that triggered downloads of the Locky ransomware. Researchers at Comodo Threat Research Labs say it is one of the largest spam ransomware campaigns this year. Fatih...

Gratipay: Email Forgery through Mandrillapp SPF

Description :- The SPF record of gratipay.com include Mandrillapp which you are not using right now, i'm able to add gratipay.com in my account, although a further verification of domain is required but you should know that Mandrillapp allow to send email from a domain if its SPF records point...

Apple iOS Malicious Email Forgery Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in the handling of HTML emails in Apple iOS allows an attacker to send a special email where the message can be viewed with an arbitrary WEB page to replace the message content...

HackerOne: SPF whitelist of mandrill leads to email forgery

I just sent a forged email to [email protected] that appears to originate from [email protected]. I was able to do this because of the following SPF record: dig txt hackerone.com hackerone.com. 299 IN TXT "v=spf1 include:spf.google.com include:sendgrid.net include:mail.zendesk.com...