22 matches found
SUSE CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
Mozilla Thunderbird < 158.0.1
The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was...
Mozilla Thunderbird < 158.0.1
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which...
Mozilla Thunderbird < 153.5.1
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which...
Linux Distros Unpatched Vulnerability : CVE-2026-113866
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that...
Mozilla Thunderbird < 153.5.1
The version of Thunderbird installed on the remote Windows host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was...
DEBIAN-CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
UBUNTU-CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866
A flaw was found in Thunderbird. An information disclosure issue occurs during account setup when the Exchange AutoDiscover feature transmits requests over unencrypted Hypertext Transfer Protocol HTTP. A network attacker monitoring traffic can intercept these plaintext requests, exposing the user...
CVE-2026-113866
A flaw in Thunderbird allows a network attacker to intercept user credentials during account setup. The Exchange AutoDiscover lookup incorrectly queries the domain's AutoDiscover service over unencrypted HTTP , including the user's entered credentials in the plaintext request. An attacker monitor...
EUVD-2026-105293
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866 Account password sent unencrypted during Exchange account setup
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866 Account password sent unencrypted during Exchange account setup
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
CVE-2026-113866
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...
PT-2026-118618
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.5.1 Thunderbird versions prior to 158.0.1 Description During account setup, the Exchange AutoDiscover lookup sends an unencrypted request over plain HTTP to the domain's AutoDiscover service. A bug causes this...
Security Vulnerabilities fixed in Thunderbird 153.5.1 — Mozilla
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. Thunderbird did n...
Security Vulnerabilities fixed in Thunderbird 158.0.1 — Mozilla
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. Thunderbird did n...
Red Hat: CVE-2026-113866: thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...