426 matches found
Sql injection
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: subscriberemail...
LocalTapiola: HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutesti
Basic report information Summary: HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutesti Description: Tonttutesti´s kutsu kaverisi feature sends email to friend with a link to Localtapiola´s tonttutesti site. Fields "Nimesi" and "Kaverisi nimi" seem to be vulnerable...
OLX: Combined attacks leading to stealing user's account
Hello, First: I have found out that when I register an account with the an email already used it doesn't tell anything but it sends a link to the registered email and when the user visits the link the password is changed without any further checking if the user was the one who asked for password...
EllisLab CodeIgniter Arbitrary Code Execution Vulnerability
EllisLab CodeIgniter is the United States EllisLab company for PHP web developers to use a set of application development framework and toolkit . A security vulnerability exists in the system/libraries/Email.php file in EllisLab CodeIgniter versions prior to 3.1.3. A remote attacker can exploit...
Code injection
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
UBUNTU-CVE-2016-4552
Cross-site scripting XSS vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message...
Thru Managed File Transfer Portal Cross-Site Scripting Vulnerability
Thru Managed File Transfer Portal is a web-based file transfer application. A cross-site scripting vulnerability exists in Thru Managed File Transfer Portal version 9.0.2. It allows an attacker to send an email to a victim with malicious content...
How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]
When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...
The vulnerability of the Mozilla SeaMonkey software package allows a malicious individual to inject any web script or HTML code they desire.
Mozilla SeaMonkey software contains a vulnerability related to cross-site scripting XSS. Exploiting this vulnerability allows malicious actors to inject arbitrary web scripts or HTML code through an email containing a data:URL element within an OBJECT or EMBED tag...
Crlf injection
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...
Cybozu Garoon Email Read Vulnerability (CNVD-2016-03720)
Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, etc. and supports free switching among three languages Chinese, Japanese, and English. A security vulnerability exists in Cybozu Garoon...
Vulnerability in Samsung SecEmailUI
Samsung SecEmailUI is a set of apk for email reader for email client from Samsung South Korea. A security vulnerability exists in Samsung SecEmailUI. The vulnerability can be exploited by an attacker to execute arbitrary JavaScript code by tricking a user into viewing an email with HTML code tags...
PT-2015-3020
Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 through 2016 Office versions 2010 SP2 Word 2010 version SP2 Word 2013 versions SP1 through RT SP1 Office Compatibility Pack version SP3 Description The issue allows remote attackers to execute arbitrary code vi...
northamptonshire.gov.uk XSS vulnerability
Open Bug Bounty ID: OBB-112286 Description| Value ---|--- Affected Website:| northamptonshire.gov.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Microsoft Excel for Mac Cross-Site Scripting Vulnerability
Microsoft Excel is one of the components of Microsoft office, the office software of Microsoft Corporation Microsoft. A cross-site scripting vulnerability in Microsoft Excel for Mac 2011,Excel 2016 for Mac version allows remote attackers to cause the insertion of arbitrary web script or HTML page...
DigitalSellz: The email updates issues
The email message content at the https://www.digitalsellz.com/user//email-updates page contrary to the email customization one is not validated properly. So this form allows all the html tags and their parameters. For example, all the following tags are sent as is: Link Link alert3 and all their...
Apple iOS Malicious Email Forgery Vulnerability
Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in the handling of HTML emails in Apple iOS allows an attacker to send a special email where the message can be viewed with an arbitrary WEB page to replace the message content...
WordPress Plugin Video Gallery 2.8 - Arbitrary Mail Relay
WordPress Plugin Video Gallery 2.8 - Arbitrary Mail Relay Exploit Title : Wordpress Video Gallery 2.8 Unprotected Mail Page Exploit Author : Claudio Viviani Website Author: http://www.homelab.it http://archive-exploit.homelab.it/1 Full HomelabIT Vulns Archive Vendor Homepage :...
WordPress Video Gallery 2.8 Unprotected Mail Page
Exploit Title : Wordpress Video Gallery 2.8 Unprotected Mail Page Exploit Author : Claudio Viviani Website Author: http://www.homelab.it http://archive-exploit.homelab.it/1 Full HomelabIT Vulns Archive Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery Software...
