Design/Logic Flaw

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two sequences and then inject arbitrary SMTP commands...

CVE-2021-38189

The CVE-2021-38189 issue affects the lettre crate (Rust) prior to 0.9.6. In the body of an email, an attacker can place a dot after two consecutive CRLF sequences, enabling arbitrary SMTP command injection after the message ends. This represents a control-flow vulnerability in SMTP handling rathe...

Cybozu Garoon 授权问题漏洞

An operational restriction bypass vulnerability exists in e-mail in Cybozu Garoon, a portal-based OA office system of Cybozu Japan. An attacker can use this vulnerability to change e-mail data without proper privileges...

UBUNTU-CVE-2021-36092

It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG OTRS Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior version...

Engel & Völkers Technology GmbH: HTML Injection in Email

Description: Hi team I have found a HTML Injection vulnerability in your system. Steps to Reproduce: 1. Navigate to https://seller-pages.engelvoelkers.com/ 2. Go to the bottom of the webpage and click on message box at right corner. 3. Fill out the form and enter the HTML payload in First Name an...

CVE-2020-22168

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

OTRS AG 跨站脚本漏洞

OTRS AG is an application of the German company OTRS. A service management software. OTRS AG suffers from a cross-site scripting vulnerability that can be triggered by an attacker sending a specially designed e-mail to the system...

JWT leak via Open Redirect in Programmatic access

Impact Using programmatic access on protected sites, one can get a signed login URL with pomeriumredirecturi set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomeriumredirecturi with a JWT attached. This allows an outside attack...

OPENSUSE-SU-2021:0646-1 Security update for postsrsd

This update for postsrsd fixes the following issues: Update to release 1.11 boo1180251 Drop group privileges as well as user privileges Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. CVE-2020-35573 Update to release 1.6 Fix endianness issue wit...

Vaadin flow 资源管理错误漏洞

Vaadin flow is an application. vaadin platform Java framework for building modern websites that look good, perform well and delight you and your users. vaadin: vaadin-text-field-flow versions 2.0.4 through 2.3.2 are vulnerable to resource management errors, which can be exploited by attackers to ...

Samsung Email Information Disclosure Vulnerability (CNVD-2021-30495)

Samsung Email application is a cell phone application from Samsung South Korea. It provides the function of sending and receiving e-mail. A security vulnerability exists in Samsung Email versions prior to 6.1.41.0, which originates from leaking messages in certain mailboxes in clear text. No...

CVE-2021-25376

An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed...

CVE-2021-20629

Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors...

Multiple vulnerabilities in Cybozu Office

Overview Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1657 Operational restrictions bypass vulnerability in Scheduler CWE-264 - CVE-2021-20624 CyVDB-1727 Operational restrictions bypass vulnerability in Bulletin Board CWE-264 - CVE-2021-20625...

Cybozu Office 跨站脚本漏洞

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A cross-site scripting vulnerability exists in e-mail in Cybozu Office. The vulnerability can be exploited to execute arbitrary script in a logged-in user's web browser...

Denial Of Service (DoS)

dovecot is vulnerable to denial of service DoS. The vulnerability exists through improper input validation in lda, lmtp, and imap, on email message with certain choices for ten thousand MIME parts...

U.S. Dept Of Defense: Sending trusted ████ and ██████████ emails through public API endpoint in ███████ site

Summary: A publicly accessible endpoint at PUT https://████████does not validate any of its four parameters: to, from, subject, text. This enables sending email to any address, with any content, with any from address, on a server that is in ██████whitelist. Such services include, but are not...

VTiger v7.0 CRM - 'To' Persistent XSS

Exploit Title: VTiger v7.0 CRM - 'To' Persistent XSS Date: 2020-11-18 Exploit Vulnerability-Lab Vendor Homepage: https://www.vtiger.com/open-source-crm/download-open-source/ Software Link: https://sourceforge.net/projects/vtigercrm/files/ Version: v7.0 Document Title: =============== VTiger v7.0...

HCL Notes Email Compose Buffer Overflow Vulnerability

HCL Notes is a local e-mail client. A security vulnerability exists in HCL Notes Email Compose, which can be exploited by an attacker to crash HCL Notes or execute attacker-controlled code on the client...

CVE-2020-27742

CVE-2020-27742 affects Citadel WebCit (through version 926) and is an Insecure Direct Object Reference vulnerability that lets an authenticated remote attacker read someone else’s emails via the msg_confirm_move template. The vulnerability is documented across multiple sources (NVD entry and Red ...