DLA-0011-1 libemail-address-perl - security update

Bulletin has no description...

Debian DSA-2969-1 : libemail-address-perl - security update

Bastian Blank reported a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation. Email::Address::parse used significant time on parsing empty quoted strings. A remote attacker able to supply specifically crafted input to an application using...

Phabricator: Broken Authentication and Session Management

Hi, Hope you are good! Steps to repro: 1 Create a Phabricator account having email address "[email protected]". 2 Now Logout and ask for password reset link. Don't use the password reset link sent to your mail address. 3 Login using the same password back and update your email address to "[email protected]" and veri...

Israeli hacker found a Gmail vulnerability to traverse the user's email address-bug warning-the black bar safety net

When one day you have the opportunity to encounter all of the gmail mailbox, you will what is empathy? On the Internet every two to three users will have a user using Gmail as a mail service provider, and the gmail mailbox is also become for us in the second element in the critical social account...

Israeli hacker found a Gmail vulnerability to traverse all the user's e-mail address-vulnerability warning-the black bar safety net

When one day you have the opportunity to encounter all of the gmail mailbox, you will what is empathy for? On the Internet every two to three users will have a user using Gmail as a mail service provider, and the gmail mailbox is also become for us in the second element in the critical social...

Direct Object Reference - User Information Disclosure

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46864. panel A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious...

Localize: missing sender policy framework (SPF)

A Valid TXT Record was not found in localize.im This can spoof your email address. Proof of Concept: http://mxtoolbox.com/SuperTool.aspx?action=spf:localize.im&run=toolpage related article: Missing SPF for hackerone.com...

Khan Academy: User guessing/enumeration at sw.khanacademy.org

Hi there, I've discovered a possibility to check whether a specific email address is associated with an account at sw.khanacademy.org. An attacker could use this issue to gather some information about his victim. Details - Host: sw.khanacademy.org - URL: https://sw.khanacademy.org/forgotpw -...

C2FO: User guessing/enumeration at https://app.c2fo.com/api/password-reset

Hi there, I noticed a small information leak which allows an attacker to check whether an email address is associated with an account. Steps to reproduce: 1. Send a POST-Request to the url https://app.c2fo.com/api/password-reset as the following example shows: POST /api/password-reset HTTP/1.1...

Sql injection

Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...

CVE-2014-1644

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

OkCupid: DOM based XSS in changing email address

a dom based xss in your site . path : https://www.okcupid.com/settings fill the email address with this : " check the images...

CVE-2014-2325

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the 1 state parameter to objects/who/index.htm or 2 User email address to quarantine/spam/manage.htm...

HackerOne: Accepting Invalid characters on email address

I tried to change my email address on hackerone.com.And when I tried adding null Bytes,it was being accepted by hackerone.com. I am registered wth ███ and I tried to change my email address to ████%00 And guess what,this address was granted as an email address...

CVE-2014-2325: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the 1 state parameter to objects/who/index.htm or 2 User email address to quarantine/spam/manage.htm...

HackerOne: Adding an user email address to the list before confirming.

I know many of the penetration tester's email address.And many of them will be interested to join on hackerone. Well lets think of a scenario. I used some other penetration tester's email address to create an account on hackerone.And I choosed the username to be "somethingerotic" I know that user...

Apple Facetime Information Disclosure

Affected Vendor: https://www.apple.com/ - Affected Software: Safari/Facetime on iOS - Affected Version: iOS 7 prior to 7.1 - Issue Type: Lack of user confirmation leading to a call being established, revealing the user's identity phone number or email address - Release Date: March 10, 2014 -...

CVE-2013-7177

config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

CVE-2013-7176

config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

UBUNTU-CVE-2013-7177

config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...