X2Engine 5.0.4 Platinum Edition Cross Site Request Forgery

Affected software: x2 engine Type of vulnerability: csrf URL: http://demo.x2engine.com Discovered by: Provensec Website: http://www.provensec.com version :X2Engine 5.0.4 Platinum Edition Proof of concept x2 engine was not using any csrf token which causes a csrf issue which an attacker can use to...

Debian DSA-3085-1 : wordpress - security update

Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at - CVE-2014-9031 Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability XSS ...

Люди готовы "на всё" ради бесплатного WiFi

Специалисты из компаний F-Secure, Британского института по информационной безопасности и немецкой компании SySS провели совместное исследование, насколько обычные пользователи готовы подключаться к бесплатному хотспоту, даже если это подключение представляет потенциальную опасность. Для проверки,...

KMMail 1.0 E-Mail HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6013/info kmMail does not sufficiently sanitize HTML and script code from the body of e-mail messages. As a result, an attacker may send a malicious message to a user of kmMail that includes arbitrary HTML and script code...

Microsoft Internet Explorer 5/6 XML Redirect File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5560/info A flaw in Microsoft Internet Explorer may reveal the entire contents of XML files and partial contents of other files to attackers. This vulnerability allows an attacker to read the entire contents of XML files,...

uebimiau webmail 2.7.2 - Stored XSS

No description provided by source. !/usr/bin/python ''' Exploit Title: Uebimiau Webmail Stored XSS Date: 17/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.uebimiau.org/ Software Link: http://www.uebimiau.org/downloads/uebimiau-2.7.2-any.zip Version: 2.7.2 Gr33Tz:...

OTRS < 2.3.6 Email From Line DoS Vulnerability

Open Ticket Request System OTRS is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

NGS000268 Technical Advisory: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email

======= Summary ======= Name: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email Release Date: 30 November 2012 Reference: NGS00268 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk:...

CVE-2012-1103

emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message...

4Images 1.7.7 Cross Site Request Forgery

Title: 4images - Image Gallery Management System - CSRF Change mail user or admin Author: Dmar al3noOoz Mail : wafeesathotmail.com Name : 4images - Image Gallery Management System dork : Google Dork: "4images - Image Gallery Management System" Software Link : http://www.4homepages.de Version: 1.7...

CVE-2011-2023

Cross-site scripting XSS vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message...

Graugon Forum 1.3 SQL Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ --Description-- A SQL injection vulnerability in Graugon Forum 1.3 can be exploited to extract arbitrary data. In some environments it may be possible to create a PHP...

CVE-2008-7281

Open Ticket Request System OTRS before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field...

CVE-2010-4766

The AgentTicketForward feature in Open Ticket Request System OTRS before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a...

CVE-2010-4767

Open Ticket Request System OTRS before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service duplicate tickets and duplicate auto-response...

Exim MTA string_format Remote Code Execution (CVE-2010-4344)

The Exim mail server is a full featured mail transfer agent MTA used in Unix-like platforms. It contains implementations of SMTP server for incoming messages as well ,as a SMTP or LMTP client for incoming email. A heap buffer overflow vulnerability has been reported in Exim Mail Transfer Agent MT...

CVE-2010-2728

Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows remote attackers to execute arbitrary code via a crafted e-mail message, aka "Heap Based Buffer Overflow in Outlook Vulnerability."...

CVE-2010-0816

CVE-2010-0816 is a remote code execution vulnerability affecting Microsoft Outlook Express 5.5 SP2, 6, 6 SP1; Windows Live Mail on Windows XP SP2/SP3, Vista SP1/SP2, Windows Server 2008 (Gold, SP2, R2), and Windows 7; and Windows Mail on Vista SP1/SP2, Server 2008 (Gold, SP2, R2), and Windows 7. ...

LaNewsFactory 1.0.0 Anonymous Email / Command Execution

LaNewsFactory Multiple Remote Vulnerabilities http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt Name LaNewsFactory Vendor Christophe Brocas Versions Affected = 1.0.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.n...

CVE-2010-1132

The mlfienvrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message...