Raft of Exim Security Holes Allow Linux Mail Server Takeovers

A veritable cornucopia of security vulnerabilities in the Exim mail server have been uncovered, some of which could be chained together for unauthenticated remote code execution RCE, gaining root privileges and worm-style lateral movement, according to researchers. The Qualys Research Team has...

Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated admin+ Stored XSS issues. Notes WPScanTeam - The original reporter mentioned the issue being fixed in 2.10.2, but we could still trigger i...

Dropcontact: Unauthorized Access and updation of EMAIL settings of other user at https://app.dropcontact.io/app/sponsorship/ by changing the " email " parameter.

When changing email settings with firstpromoter, the email of the account was right in the url, so by changing this parameter, we could change setting of other users...

CVE-2020-7912

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups...

WTCMS Arbitrary PHP Code Execution Vulnerability

WTCMS is a ThinkPHP-based content management system CMS. An arbitrary PHP code execution vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to execute PHP code by uploading an image file with the help of the registration email template page in the email settings...

CVE-2019-8318

An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...

CVE-2018-15748

On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.152335dn MFP 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of t...

CVE-2017-11726

services/systemio/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery CSRF, as demonstrated by changing an e-mail address setting...

Instacart: CSRF To change Email Notification Settings

Hi i found CSRF To change Email Notification Settings The Code Of the HTML Page :: For Fixing you Must add CSEF Token to the Request i attached Video Showing the Bug Thanks...

Stash email settings fields can be inadvertently be populated by browser with user login details - security issue

The email and username password in the email server settings screen has the same names as the username and password fields when logging in. This has the unintentional side affect of being pre-populated by your browser if you have left the mail server credentials blank and your browser has saved...

Epicor Enterprise 7.4 - Multiple Vulnerabilities

No description provided by source. "Epicor Enterprise vulnerabilities" - Affected vendor: Epicor Software Corporation - Affected system: Epicor Enterprise - Version 7.4 - Vendor disclosure date: May 13th, 2014 - Public disclosure date: September 30th, 2014 - Status: Fixed - Associated CVEs: 1...

Real Estate SQL Injection Vulnerability

No description provided by source. Description Linux And window Version available: This software is available in both windows and linux version. It runs on asp and php extension. Listings: We can add unlimited property listing, with the property photo. System automatically creates three thumbnail...

X-Ray 2.0 - VirusTotal frontent version for Suspicious Files Auto Submit

Raymond announce X-Ray 2.0, a program which is frontend for VirusTotal multi scanner. X-Ray will provide users with automatic submission of files that you think are suspicious to 35 Agnitum, Antiy Labs, Avast, AVG, Avira, Bitdefender, QuickHeal, ClamAV, Comodo, Dr.Web, Emsisoft, ESET, F-Prot,...

Real Estate - SQL Injection

Real Estate - SQL Injection Description Linux And window Version available: This software is available in both windows and linux version. It runs on asp and php extension. Listings: We can add unlimited property listing, with the property photo. System automatically creates three thumbnail photo ...

Уязвимость серверов mail.com

Слабая схема генерации маркетра доступа позволяет подменить маркер доступа получив доступ к почте и настройками другого пользователя на любых почтовых серверах использующих П/О от mail.com...