DEBIAN-CVE-2021-4185

Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file...

Apache Sling Commons Messaging Mail Trust Management Issue Vulnerability

Apache Sling Commons Messaging Mail is an open source messaging mail service from the Apache Foundation in the U.S. A trust management issue vulnerability exists in Apache Sling Commons Messaging Mail 1.0.0, which stems from the Apache Sling Commons Messaging Mail provides a simple layer on top o...

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JND...

Mojo messaging library Code Execution

The vulnerability of the Mojo messaging library in Microsoft Edge and Google Chrome lies in the insufficient validation of input data during the processing of HTML content. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created malicious web...

SiPass Integrated Access Control Vulnerability

SiPass integrated is an access control system. With the SiPass integrated access control vulnerability, an affected application does not adequately restrict access to the internal message broker system. An attacker could exploit the vulnerability to subscribe to arbitrary message queues...

CVE-2021-38950

IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

CVE-2021-44549 affects Apache Sling Commons Messaging Mail (Sling Mail) implementations that use SMTPS. The issue arises from the SimpleMailService in Apache Sling Commons Messaging Mail 1.0 which lacked an option to enable mail.smtps.ssl.checkserveridentity by default, leaving SMTPS connections ...

CVE-2021-44549 SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

Apache Sling Commons Messaging Mail Trust Management Vulnerability

Apache Sling Commons Messaging Mail is an open source messaging mail service from the Apache Foundation in the U.S. A trust management issue vulnerability exists in Apache Sling Commons Messaging Mail 1.0.0, which stems from the Apache Sling Commons Messaging Mail provides a simple layer on top o...

PT-2021-24133

Name of the Vulnerable Software and Affected Versions: Apache Sling Commons Messaging Mail version 1.0 Description: The issue concerns the lack of an option to enable server identity checks for the shared mail session in Apache Sling Commons Messaging Mail. This increases the risk of "man in the...

CVE-2021-44549: Improper Certificate Validation

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

com.github.marcelop3251:queues-manager (1.2.0), net.oneandone.ioc-unit:ioc-unit-jms-rabbitmq (>=2.0.28, <=2.0.40) +4 more potentially affected by CVE-2020-36282 via com.rabbitmq.jms:rabbitmq-jms (>=1.8.1, <=1.14.0)

com.rabbitmq.jms:rabbitmq-jms MAVEN version =1.8.1, =2.0.28, =1.0.14, =1.0.14, =1.1.0, =1.1.0, =1.4.0 Source cves: CVE-2020-36282 Source advisory: OSV:GHSA-V525-C3G5-CG9P...

com.github.marcelop3251:queues-manager (1.2.0), net.oneandone.ioc-unit:ioc-unit-jms-rabbitmq (>=2.0.28, <=2.0.40) +4 more potentially affected by CVE-2020-36282 via com.rabbitmq.jms:rabbitmq-jms (>=1.8.1, <=1.14.0)

com.rabbitmq.jms:rabbitmq-jms MAVEN version =1.8.1, =2.0.28, =1.0.14, =1.0.14, =1.1.0, =1.1.0, =1.4.0 Source cves: CVE-2020-36282 Source advisory: GHSA-V525-C3G5-CG9P...

Law Enforcement Access to Chat Data and Metadata

A January 2021 FBI document outlines what types of data and metadata can be lawfully obtained by the FBI from messaging apps. Rolling Stone broke the story and its been written about elsewhere. I dont see a lot of surprises in the document. Lots of apps leak all sorts of metadata: iMessage and...

[SECURITY] Fedora 34 Update: matrix-synapse-1.48.0-1.fc34

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

[SECURITY] Fedora 35 Update: matrix-synapse-1.48.0-1.fc35

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

Fedora: Security Advisory for matrix-synapse (FEDORA-2021-9758549fce)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...