[SECURITY] [DSA 4690-1] dovecot security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4690-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 20, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4690-1] dovecot security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4690-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 20, 2020 https://www.debian.org/security/faq -...

USN-4361-1: Dovecot vulnerabilities

Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service. CVE-2020-10957, CVE-2020-10967 Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to...

keycloak: improper verification of certificate with host mismatch could result in information disclosure

A flaw was found in Keycloak, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack...

If You Can't Patch Your Email Server, You Should Not Be Running It

--- CVE-2020-0688 Scan Results, per Rapid7 tl;dr -- it's the title of the post: "If You Can't Patch Your Email Server, You Should Not Be Running It." I read a disturbing story today with the following news: "Starting March 24, Rapid7 used its Project Sonar internet-wide survey tool to discover al...

Information Disclosure Vulnerability in Multiple Rockwell Automation Products

Rockwell Automation MicroLogix 1400 Controllers Series A and so on are the products of Rockwell Automation, Inc.Rockwell Automation MicroLogix 1400 Controllers Series A is a programmable logic controller.MicroLogix 1100 Controllers is a programmable logic controller.RSLogix 500 Software is a set ...

New OpenSMTPD RCE Flaw Affects Linux and OpenBSD Email Servers

OpenSMTPD has been found vulnerable to yet another critical vulnerability that could allow remote attackers to take complete control over email servers running BSD or Linux operating systems. OpenSMTPD , also known as OpenBSD SMTP Server, is an open-source implementation of the Simple Mail Transf...

Critical OpenSMTPD Bug Opens Linux and OpenBSD Mail Servers to Hackers

Cybersecurity researchers have discovered a new critical vulnerability CVE-2020-7247 in the OpenSMTPD email server that could allow remote attackers to take complete control over BSD and many Linux based servers. OpenSMTPD is an open-source implementation of the server-side SMTP protocol that was...

MDaemon Email Server Cross-Site Scripting Vulnerability

MDaemon Email Server is an email server. A cross-site scripting vulnerability exists in MDaemon Email Server version 17.5.1. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side code...

WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting

WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting Exploit Title: WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/plugins/postie/readme.txt Date: 2020-01-15 Exploit Author: V1n1v131r4 Vendor Homepage: https://postieplugin.com/ Software...

[SECURITY] Fedora 31 Update: cyrus-imapd-3.0.13-1.fc31

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

[SECURITY] Fedora 30 Update: cyrus-imapd-3.0.13-1.fc30

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

CVE-2019-19497

MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message...

CVE-2019-19497

MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message...

Cross site scripting

MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message...

CVE-2019-19497

MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message...

CVE-2019-19497

CVE-2019-19497 affects MDaemon Email Server 17.5.1 and is a Cross‑Site Scripting (XSS) vulnerability triggered by the filename of an email attachment. Public docs identify the root cause as a lack of proper validation of client‑side data by the web application, enabling injection of script throug...

Mail.ru: An implementation flaw in Mail.ru can be exploited for DKIM signature spoofing and email spoofing

Domain, site, application -- https://e.mail.ru Quick note: this report is different from my previous report Report 727233 , and is not policy configuration or enforcement issue as well. TL;DR --------- This report disclosure an implementation bug, which chains multiple features in the Mail.ru...

SQL Injection Vulnerability in TurboMail

TurboMail is a Guangzhou Topo Software Technology Co., Ltd. for enterprises and institutions to develop the communication needs of the e-mail server system. TurboMail SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

Trump Campaign Website Left Open to Email Server Hijack

A mistake made by website developers left an official re-election website for President Donald Trump open to attack. The error, impacting hundreds of other websites as well, is tied to a website development tool called Laravel, used to test sites before they go live. The tool, accidentally left...