827 matches found
Microsoft Outlook 97/98/2000/4/5 Address Book Spoofing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2823/info Outlook Express is the standard e-mail client that is shipped with Microsoft Windows 9x/ME/NT. The address book in Outlook Express is normally configured to make entries for all addresses that are replied to by...
eM Client e-mail client 5.0.18025.0 - Stored XSS vulnerability
No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/ Software Download:...
Winmail邮件正文存储型xss（有触发条件）
简要描述： 一款功能风格很像qq邮箱的产品，可惜安全比qq邮箱差一些 详细说明： 简单的说就是正文作了处理，但是用户回复或者转发时没做好处理，导致了存储型XSS。 用户A给用户B发送邮件，正文部分可以写一篇很长的个人感情带color的故事或者B喜欢的某类风格文字来吸引B看下去（为何要长，待下面说明），在正文的最后加上xss语句： 点击发送，B用户收到邮件打开第一眼一看是看不到xss code的 ，所以标题起的诱惑点，正文长一点，用户极有可能就直接转发给需要通知的人了，而在用户回复或者转发邮件的时候即触发XSS...
Threat Outbreak Alert: Fake Email Client Application Update Instructions Email Messages on April 18, 2014
Medium Alert ID: 33854 First Published: 2014 April 18 18:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain email settings update instructions for the recipient. The text in the email message attempts to convince the...
Mozilla多个产品更新文件权限设置漏洞
CVE ID:CVE-2014-1496 Mozilla Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。 Mozilla多个产品在升级过程中把文件展开后没有设置这些文件为只读属性，允许攻击者利用漏洞在升级过程中修改或替换这些文件。 0 Mozilla Firefox 27 Mozilla Firefox ESR 24.3 Mozilla Thunderbird 24.3 Mozilla Seamonkey 2.24 Mozilla Firefox 28，Firefox ESR 24.4，Thunderbird...
How to use PGP encryption with Mozilla Thunderbird Email client
In my last article, we have learnt that how to encrypt our Emails using Gnu Privacy Guard. Previously we used Microsoft Outlook as a desktop mail client and a GpgOL plugin to handle encryption decryption of our communication. Since Microsoft is a US-based company, that has to follow all the laws ...
Ability Mail Server 2013 (3.1.1) 存储型跨站脚本漏洞
No description provided by source. !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server...
Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...
Mozilla Firefox/Thunderbird/SeaMonkey未明内存破坏漏洞
CVECAN ID: CVE-2013-5610 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox/SeaMonkey/Thunderbird所使用的浏览器引擎存在未明内存破坏漏洞，允许攻击者构建恶意WEB页，诱使用户解析，可使应用程序崩溃或以应用程序上下文执行任意代码。 0 Mozilla Firefox 26 Mozilla Thunderbird 24.2 Mozilla SeaMonkey 2.23 Mozilla Firefox ESR 24.2 厂商补丁：...
Debian DSA-2805-1 : sup-mail - command injection
joernchen of Phenoelit discovered two command injection flaws in Sup, a console-based email client. An attacker might execute arbitrary command if the user opens a maliciously crafted email. - CVE-2013-4478 Sup wrongly handled the filename of attachments. - CVE-2013-4479 Sup did not sanitize the...
[SECURITY] [DSA 2805-1] sup-mail security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2805-1 [email protected] http://www.debian.org/security/ Luciano Bello November 27, 2013 http://www.debian.org/security/faq -...
DSA-2805-1 sup-mail - remote command injection
Bulletin has no description...
Debian Security Advisory DSA 2805-1 (sup-mail - command injection)
joernchen of Phenoelit discovered two command injection flaws in Sup, a console-based email client. An attacker might execute arbitrary command if the user opens a maliciously crafted email. CVE-2013-4478 Sup wrongly handled the filename of attachments. CVE-2013-4479 Sup did not sanitize the...
Microsoft Outlook MIME Email Message Parsing Remote Code Execution (MS13-068; CVE-2013-3870; CVE-2013-3905)
A remote code execution vulnerability exists in Microsoft Office Outlook email client...
OTRS < 2.4.7 AgentTicketForward Information Disclosure Vulnerability
Open Ticket Request System OTRS is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
eM Client e-mail client v5.0.18025.0 Stored XSS vulnerability
eM Client e-mail client version 5.0.18025.0 suffers from a stored cross site scripting vulnerability. !/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor...
eM Client e-mail client 5.0.18025.0 - Persistent Cross-Site Scripting
!/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/ Software Download: http://www.emclient.com/download Tested on: Windows X...
eM Client e-mail client 5.0.18025.0 - Persistent Cross-Site Scripting
eM Client e-mail client 5.0.18025.0 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/...
eM Client 5.0.18025.0 Cross Site Scripting
!/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/ Software Download: http://www.emclient.com/download Tested on: Windows X...
Mozilla多个产品不正确XMLHttpRequest调用限制漏洞
CVE ID:CVE-2013-1714 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端 Mozilla Firefox/SeaMonkey/Thunderbird Web Workers实现不正确限制XMLHttpRequest调用，允许远程攻击者利用漏洞绕过同源策略，进行跨站脚本攻击，可获取敏感信息或劫持用户会话 0 Mozilla Firefox 23.0 Mozilla Firefox ESR 17.x Mozilla Thunderbird 17.0.8 Mozilla Thunderbi...