Radancy: [mijn.werkenbijdefensie.nl] Denial of service occurs due to lack of email length confirmation

Creating an account on https://mijn.werkenbijdefensie.nl/profielaanmaken/ could be done with a very long emailaddress. A max email address length validation check has been implemented as per RFC the maximum length allowed for an email address is 255 characters. However, we don't validate email...

SRC-2020-0020 : Microsoft SharePoint Server ExchangeAutodiscover GetDataFromURL Blind Server-Side Request Forgery Tampering Vulnerability

Vulnerability Details: This vulnerability allows remote attackers escalate privileges under certain conditions. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetFreeBusyStatusForOneUser function inside of the AsynchronousWebPartService class. The...

Insecure Direct Object Reference

github.com/gogs/gogs is vulnerable to insecure direct object reference. A remote attacker is able to configure and set the primary email address of other users on their behalf...

Mattermost Server Information Disclosure Vulnerability (CNVD-2020-41486)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server that stems from the program not properly handling changes to email addresses. An attacker could exploit the vulnerability to compromise...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35328)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.0.0. An attacker could exploit the vulnerability to change the account name and e-mail address of an LDAP account...

CVE-2017-18887

CVE-2017-18887: Mattermost Server versions affected are prior to 4.3.0, 4.2.1, and 4.1.2. The issue discloses the team creator’s e‑mail address to members, constituting an information disclosure vulnerability. Connected sources confirm the description across Red Hat, SUSE, GNAs and OSV entries, w...

CVE-2019-20890

An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions...

CVE-2019-20879

An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry...

CVE-2019-20875

Mattermost Server vulnerable versions prior to 5.9.0, 5.8.1, 5.7.3, and 4.10.8 allow a password reset to proceed while an email address is being changed. Nexus of the issue is not detailed in the provided documents beyond this description. Affected component is the password reset flow; root cause...

CVE-2019-20875

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed...

RHEL 7 : python (RHSA-2020:2520)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2520 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Authorization

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization...

Moderate: Red Hat Security Advisory: python security update

An update for python is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Atlassian Fisheye and Crucible Information Disclosure Vulnerability (CNVD-2020-38890)

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. An information disclosure vulnerability exists in /json/fe/activeUserFinder.do in Altassian Fisheye a...

USN-4373-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. CVE-2020-6831, CVE-2020-12387, CVE-2020-12395 It wa...

thunderbird security update

CentOS Errata and Security Advisory CESA-2020:2050 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Information Disclosure

typo3/cms-core is vulnerable to information disclosure. A remote attacker is able to discover valid email address via the password reset function by analyzing the server response time upon submitting the password reset with an arbitrary email address...

Phishing Attack

thunderbird is vulnerable to phishing attack. The vulnerability exists as the sender Email Address can be spoofed using encoded Unicode characters...

GLSA-202005-03 : Mozilla Thunderbird: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202005-03 Mozilla Thunderbird: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able t...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200511)

Security Fixes : - Mozilla: Use-after-free during worker shutdown CVE-2020-12387 - Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 CVE-2020-12395 - usrsctp: Buffer overflow in AUTH chunk input validation CVE-2020-6831 - Mozilla: Arbitrary local file access with 'Copy as cURL'...