CVE-2020-12397

By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird 68.8.0...

PSF-2019-16 Email header injection in Address objects

It is possible to inject email headers using CR or LF character. The fix disallows CR and LF characters in email.headerregistry.Address arguments to guard against header injection attacks...

FreeBSD : python 3.6 -- multiple vulnerabilities (18ed9650-a1d6-11e9-9b17-fcaa147e860e)

Python changelog : bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and localfile:// URL schemes in URLopener.open and URLopener.retrieve of urllib.request. bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit. bpo-30458: Address CVE-2019-9740 by...

PHPMailer < 2.0.7 / 2.1, 2.2 < 2.2.1 Email Header Injection Vulnerability

PHPMailer is prone to an email header injection vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

Android Gmail < 7.11.5.176568039 - Directory Traversal in Attachment Download Exploit

There is a directory traversal issue in attachment downloads in Gmail. For non-gmail accounts, there is no path sanitization on the attachment filename in the email, so when attachments are downloaded, a file with any name and any contents can be written to anywhere on the filesystem that the Gma...

Design/Logic Flaw

Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers...

CVE-2016-4868

Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests...

Design/Logic Flaw

Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests...

CVE-2016-4868

Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests...

CVE-2016-4868

Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests...

CVE-2016-4868

CVE-2016-4868 affects Cybozu Office 9.0.0–10.4.0. The vulnerability is an email header injection in the send process that allows remote attackers to modify email headers and send unintended emails via specially crafted requests. Impact: unintended emails due to header manipulation. Remediation: U...

Design/Logic Flaw

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

Moodle email-header injection vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. An email-header injection vulnerability exists in Moodle. An attacker can exploit this...

DotCMS Email Header Injection Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in DotCMS versions prior to 3.5 and prior to 3.3.2. An attacker can exploit the...

dotCMS Email Header Injection

Title: CVE-2016-4803 dotCMS - Email Header Injection Credit: Elar Lang / https://security.elarlang.eu Vulnerability: Email Header Injection Vulnerable version: before 3.5 / 3.3.2 CVE: CVE-2016-4803 Vendor: dotCMS http://dotcms.com/ Description dotCMS has an email sending functionality at path...

PayPal Bug Bounty Filter Bypass Vulnerability

PayPal is an e-commerce application that provides online payment and money transaction services. A filter bypass vulnerability exists in PayPal. A remote attacker is able to inject malicious script code into some email headers...

Symantec Encryption Management Server EMAIL Header Field Injection Vulnerability

Symantec Encryption Management Server is a single console for managing multiple encryption applications in the PGP platform. Symantec Encryption Management Server does not properly handle email header field data, which can be exploited by a remote attacker to conduct email header injection attack...

Symantec Encryption Management Server Database Backup Command Line Injection and Email Header Inject

SUMMARY Symantec Encryption Management Server is susceptible to a shell command line injection when an authorized, but less privileged administrator, is submitting a request for a database backup. This could potentially result in the malicious administrator gaining privileged access on the server...

CVE-2014-3618

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."...

Heap overflow

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."...