oirs.ulaval.ca XSS vulnerability

Open Bug Bounty ID: OBB-347677 Description| Value ---|--- Affected Website:| oirs.ulaval.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Contact Manager 1.0 - femail SQL Injection

Contact Manager 1.0 - femail SQL Injection Exploit Title: Contact Manager 1.0 - SQL Injection Dork: N/A Date: 15.09.2017 Vendor Homepage: http://savsofteproducts.com/ Software Link: http://www.contactmanagerscript.com/download/contactmanager1380185909.zip Demo: http://contactmanagerscript.com/dem...

email.fatcow.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-272016 Description| Value ---|--- Affected Website:| email.fatcow.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Cross site scripting

XSS exists in Easy WP SMTP before 1.2.5, a WordPress Plugin, via the e-mail subject or body...

Microsoft Outlook - HTML Email Denial of Service

Microsoft Outlook - HTML Email Denial of Service Source: https://justhaifei1.blogspot.ca/2017/03/an-interesting-outlook-bug.html When you send this email to someone, when he/she just read the email, Outlook will crash. MSRC told me that they think it's a non-exploitable bug and it seems that they...

WordPress Invite Anyone Plugin Security Bypass Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Invite Anyone is one of the invitation components. A security bypass vulnerability exists in the by-email/by-email.php...

Sql injection

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: subscriberemail...

LocalTapiola: HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutesti

Basic report information Summary: HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutesti Description: Tonttutesti´s kutsu kaverisi feature sends email to friend with a link to Localtapiola´s tonttutesti site. Fields "Nimesi" and "Kaverisi nimi" seem to be vulnerable...

OLX: Combined attacks leading to stealing user's account

Hello, First: I have found out that when I register an account with the an email already used it doesn't tell anything but it sends a link to the registered email and when the user visits the link the password is changed without any further checking if the user was the one who asked for password...

EllisLab CodeIgniter Arbitrary Code Execution Vulnerability

EllisLab CodeIgniter is the United States EllisLab company for PHP web developers to use a set of application development framework and toolkit . A security vulnerability exists in the system/libraries/Email.php file in EllisLab CodeIgniter versions prior to 3.1.3. A remote attacker can exploit...

Code injection

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...

UBUNTU-CVE-2016-4552

Cross-site scripting XSS vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message...

Thru Managed File Transfer Portal Cross-Site Scripting Vulnerability

Thru Managed File Transfer Portal is a web-based file transfer application. A cross-site scripting vulnerability exists in Thru Managed File Transfer Portal version 9.0.2. It allows an attacker to send an email to a victim with malicious content...

How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...

The vulnerability of the Mozilla SeaMonkey software package allows a malicious individual to inject any web script or HTML code they desire.

Mozilla SeaMonkey software contains a vulnerability related to cross-site scripting XSS. Exploiting this vulnerability allows malicious actors to inject arbitrary web scripts or HTML code through an email containing a data:URL element within an OBJECT or EMBED tag...

Crlf injection

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

Cybozu Garoon Email Read Vulnerability (CNVD-2016-03720)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, etc. and supports free switching among three languages Chinese, Japanese, and English. A security vulnerability exists in Cybozu Garoon...

Vulnerability in Samsung SecEmailUI

Samsung SecEmailUI is a set of apk for email reader for email client from Samsung South Korea. A security vulnerability exists in Samsung SecEmailUI. The vulnerability can be exploited by an attacker to execute arbitrary JavaScript code by tricking a user into viewing an email with HTML code tags...

PT-2015-3020

Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 through 2016 Office versions 2010 SP2 Word 2010 version SP2 Word 2013 versions SP1 through RT SP1 Office Compatibility Pack version SP3 Description The issue allows remote attackers to execute arbitrary code vi...

northamptonshire.gov.uk XSS vulnerability

Open Bug Bounty ID: OBB-112286 Description| Value ---|--- Affected Website:| northamptonshire.gov.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...