CVE-2022-3032

When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed...

Design/Logic Flaw

If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. I...

Amazon Linux 2 : thunderbird (ALAS-2022-1900)

The version of thunderbird installed on the remote host is prior to 102.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1900 advisory. 2024-05-09: CVE-2021-28429 was added to this advisory. Integer overflow vulnerability in avtimecodemakestring in...

CVE-2022-39052 DoS attack using email

An external attacker is able to send a specially crafted email with many recipients and trigger a potential DoS of the system...

PT-2022-23668 · Samsung · Samsung Email

Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 6.1.70.20 Description: The issue is related to improper access control and intent redirection, allowing an attacker to access a specific formatted file and execute privileged behavior. Recommendations: For...

CVE-2022-2377

The CVE concerns the Directorist WordPress plugin prior to version 7.3.0, which lacks authorization and CSRF checks in an AJAX action. This allows any authenticated user to send arbitrary emails on behalf of the blog, exposing a potential abuse vector for unintended messaging. The vulnerability i...

CVE-2022-35924

NextAuth.js is a complete open source authentication solution for Next.js applications. next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.:...

Fruits Bazar SQL注入漏洞

Fruits Bazar is an e-commerce project using Php, javaScript, Jquery and Mysql by Md. Saiful Islam, an individual developer from Bangladesh. A SQL injection vulnerability exists in Fruits Bazar v1.0, which stems from a security issue with the recoveremail parameter in userpasswordrecover.php, whic...

New Zimbra Email Vulnerability Could Let Attackers Steal Your Login Credentials

A new high-severity vulnerability has been disclosed in the Zimbra email suite that, if successfully exploited, enables an unauthenticated attacker to steal cleartext passwords of users sans any user interaction. "With the consequent access to the victims' mailboxes, attackers can potentially...

CVE-2022-0745

CVE-2022-0745 affects the WordPress plugin “Like Button Rating” (LikeBtn). Connected documents confirm that versions prior to 2.6.45 allow any logged-in user (e.g., a subscriber) to send arbitrary emails to any recipient with arbitrary subject and body, via the plugin’s exposed functionality (e.g...

CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-27123

Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter...

Obscure Email Vulnerability allow anyone to signup with target email id without proper verification and Allowing malicious domain on username input field leads to business logic error by victim response fetching via email and force a user to download any file hacker want on behalf of [email protected].

Description This vulnerability is a result of an interaction between two different ways of handling e-mail addresses. Gmail ignores dots in addresses, so [email protected] is the same as [email protected] is the same as [email protected]. with this vulnerability attacker ca...

Cross site request forgery (csrf)

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its comingsoonsendmail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users...

CVE-2022-22287

Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox...

@adhawk/analytics-pixel-loader (>=0.0.2 <=2.0.2), @adhawk/analytics.js-integration-freshdesk (=0.1.0) +64 more potentially affected by CVE-2021-36716 via is-email (>=0.1.0 <=0.1.1)

is-email NPM version =0.1.0, =0.0.2, =1.2.0, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.3, =1.0.0, =1.0.18 and more Source cves: CVE-2021-36716 Source advisory: OSV:GHSA-J377-2X76-558H...

in chatwoot/chatwoot

I'll explain it briefly: A contact is created with the email address "[email protected]" and we are writing about sensitive information. userIdentifer is required to be validated with hmac. Now a human, on the other side of the world, comes into the chat and is asked by the bot for his email...

CVE-2021-40128

A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameter...

CVE-2021-20761

Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data of E-mail without the appropriate privilege...

Input validation

Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data of E-mail without the appropriate privilege...