221 matches found
PayPal Bug Bounty Filter Bypass Vulnerability
PayPal is an e-commerce application that provides online payment and money transaction services. A filter bypass vulnerability exists in PayPal. A remote attacker is able to inject malicious script code into some email headers...
Symantec Encryption Management Server EMAIL Header Field Injection Vulnerability
Symantec Encryption Management Server is a single console for managing multiple encryption applications in the PGP platform. Symantec Encryption Management Server does not properly handle email header field data, which can be exploited by a remote attacker to conduct email header injection attack...
CVE-2012-4730
Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors...
FreeBSD : RT -- Multiple Vulnerabilities (4b738d54-2427-11e2-9817-c8600054b392)
BestPractical report : All versions of RT are vulnerable to an email header injection attack. Users with ModifySelf or AdminUser can cause RT to add arbitrary headers or content to outgoing mail. Depending on the scrips that are configured, this may be be leveraged for information leakage or...
Bugzilla Multiple Security Vulnerabilities
Bugzilla is prone to the following vulnerabilities: 1. A security bypass vulnerability. 2. An email header-injection vulnerability. 3. Multiple information disclosure vulnerabilities. 4. Multiple cross-site scripting vulnerabilities. Successfully exploiting these issues may allow an attacker to...
SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules
Versions affected and proposed solutions Simple Gallery for Drupal 6.x This module creates a simple gallery using taxonomy and CCK imagefields. The module is vulnerable to a Cross Site Scripting XSS attack. This can be exploited by users with the ability to add taxonomy terms or tag content...
PHP 5.2.1 - Folded Mail Headers Email Header Injection
PHP 5.2.1 - Folded Mail Headers Email Header Injection source: https://www.securityfocus.com/bid/23145/info PHP is prone to an email-header-injection vulnerability because it fails to properly sanitize user-supplied input when constructing email messages. Exploiting this issue allows a malicious...
FreeBSD : typo3 -- email header injection (62b8f253-12d9-11dc-a35c-001485ab073e)
Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report : An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
typo3 -- email header injection
Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report: An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages...
Email header injection
A problem has been discovered where the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for. Component Type: TYPO3 Core Affected Versions: TYPO3 4.x below 4.0.5, 4.1beta, 4.1RC1, TYPO3 Versions 3.x Vulnerability Type: Email header...
[Full-disclosure] Advisory 14/2006: Dotdeb PHP Email Header Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Dotdeb PHP Email Header Injection Vulnerability Release Date: 2006/11/14 Last Modified: 2006/11/14 Author: Stefan Esser [email protected] Application: Dotdeb PHP 5.2.0 R...
Design/Logic Flaw
Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
CVE-2006-2943
Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
security flaw
CRLF injection vulnerability in the mbsendmail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds LF in the "To" address argument...
CVE-2006-1225
CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy...
BasiliX Webmail 1.1 - Email Header HTML Injection
source: https://www.securityfocus.com/bid/10662/info BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain acces...
SqWebMail 4.0.4.20040524 - Email Header HTML Injection
source: https://www.securityfocus.com/bid/10588/info SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings. The problem presents itself when an...
SquirrelMail 1.2.x - From Email Header HTML Injection
source: https://www.securityfocus.com/bid/10450/info SquirrelMail is reported to be prone to a 'from' field email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to...
