advantec.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-600088 Description| Value ---|--- Affected Website:| advantec.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000154

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page CWE-80 vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser...

CVE-2018-1000154

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page CWE-80 vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser...

sgoutlook.email XSS vulnerability

Open Bug Bounty ID: OBB-590215 Description| Value ---|--- Affected Website:| sgoutlook.email Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-7706

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

CVE-2018-7707

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...

CVE-2018-7704

CVE-2018-7704 affects SecurEnvoy SecurMail prior to 9.2.501. The vulnerability allows remote authenticated users to read arbitrary email messages via the option1 parameter in a reply action to secmail/getmessage.exe, exposing confidential data. Root cause described across sources is an insecure h...

EUVD-2018-1723

Microsoft Exchange Outlook Web Access OWA in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016...

ALPINE-CVE-2017-14461

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the...

liverpoolcarcentre.com XSS vulnerability

Open Bug Bounty ID: OBB-500253 Description| Value ---|--- Affected Website:| liverpoolcarcentre.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated...

Mozilla Patches Critical Bug in Thunderbird

Mozilla issued a critical security update to its popular open-source Thunderbird email client. The patch was part of a December release of five fixes that included two bugs rated high and one rated moderate and another low. Mozilla said Thunderbird, which is also serves as a news, RSS and chat...

Trend Micro Encryption for Email DLL Loads Remote Code Execution Vulnerability

Trend Micro Encryption for Email is a suite of encryption technologies for email from Trend Micro. A security vulnerability exists in Trend Micro Encryption for Email version 5.6. A remote attacker could exploit the vulnerability to execute arbitrary code on an affected system...

SUSE-SU-2017:3231-1 Security update for procmail

This update for procmail fixes the following issues: Security issue fixed: - CVE-2017-16844: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a...

CVE-2017-16844

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than...

oirs.ulaval.ca XSS vulnerability

Open Bug Bounty ID: OBB-347677 Description| Value ---|--- Affected Website:| oirs.ulaval.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Contact Manager 1.0 - femail SQL Injection

Contact Manager 1.0 - femail SQL Injection Exploit Title: Contact Manager 1.0 - SQL Injection Dork: N/A Date: 15.09.2017 Vendor Homepage: http://savsofteproducts.com/ Software Link: http://www.contactmanagerscript.com/download/contactmanager1380185909.zip Demo: http://contactmanagerscript.com/dem...

email.fatcow.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-272016 Description| Value ---|--- Affected Website:| email.fatcow.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Cross site scripting

XSS exists in Easy WP SMTP before 1.2.5, a WordPress Plugin, via the e-mail subject or body...

Microsoft Outlook - HTML Email Denial of Service

Microsoft Outlook - HTML Email Denial of Service Source: https://justhaifei1.blogspot.ca/2017/03/an-interesting-outlook-bug.html When you send this email to someone, when he/she just read the email, Outlook will crash. MSRC told me that they think it's a non-exploitable bug and it seems that they...

WordPress Invite Anyone Plugin Security Bypass Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Invite Anyone is one of the invitation components. A security bypass vulnerability exists in the by-email/by-email.php...