Infogram: Email notification is not being sent while changing passwords

Vulnerabilities:- 1.Use of old passwords is possiblecurrent password can be used as new password. 2.Email notification is not being sent to linked mail account while changing passwords. Impact:- Case-1:- -whenever a user requests a reset token for recovery of his account,a reset token is being to...

[SECURITY] Fedora 27 Update: procmail-3.22-44.fc27

Procmail can be used to create mail-servers, mailing lists, sort your incoming mail into separate folders/files real convenient when subscribing to one or more mailing lists or for prioritising your mail, preprocess your mail, start any programs upon mail arrival e.g. to generate different chimes...

Postfix: Privilege escalation

Background Postfix is a mail server and an alternative to the widely-used Sendmail program. Description By default, Berkeley DB reads a DBCONFIG configuration file from the current working directory. This is an undocumented behavior. Impact A local attacker, by using a specially crafted DGCONFIG...

Cyrus IMAP Denial of Service Vulnerability

Cyrus IMAP is a free, open source Unix and Linux-based operating system for supporting IMAP Interactive Mail Access Protocol protocol mail server . A security vulnerability exists in the 'mboxlistdofind' function in the imap/mboxlist.c file in Cyrus IMAP versions prior to 3.0.4. A remote attacker...

IceWarp Mail Server <= 10.4.4 XSS Vulnerability

IceWarp Mail Server is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

IceWarp Mail Server Detection Consolidation

Consolidation of IceWarp Mail Server detections. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IceWarp Mail Server Detection (HTTP)

HTTP based detection of IceWarp Mail Server. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSA Bounty: Server Side Misconfiguration (EMAIL SPOOFING)

Hi team, Bug Type: Server Security Misconfiguration Mail Server Misconfiguration Missing SPF on Email Domain Weakness: Improper Authentication Description: i observe this when i send a email from [email protected] through http://emkei.cz/ to email [email protected] and afte...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2017-29528)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in the administration panel of IceWarp Mail Server version 10.4.4. A remote attacker can exploit...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

CVE-2017-12844

IceWarp Mail Server 10.4.4 is affected by a Cross-site scripting (XSS) vulnerability in the admin panel. The flaw allows remote authenticated domain administrators to inject arbitrary web script or HTML via a specially crafted username. Documented impact is limited to injection into admin UI; no ...

Error : Sync not permitted. Account doesn't have permission to sync with the mail server.

Error : Sync not permitted. You account doesn't have permission to sync with the mail server...

VulnCheck KEV: CVE-2001-0690

Format string vulnerability in exim 3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva in batched SMTP mode allows a remote attacker to execute arbitrary code via format strings in SMTP mail headers...

UBUNTU-CVE-2015-9097

The mail gem before 2.5.5 for Ruby aka A Really Ruby Mail Library is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring...

AtMail Cross-Site Request Forgery Vulnerability (CNVD-2017-09349)

AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in Atmail versions prior to 7.8.0.2...

Postfix 2.x Mail Message Date Field RCE (ENTERSEED)

According to its banner, the Postfix mail server running on the remote host is version 2.x from 2.0.8 to 2.1.5 inclusively. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of the email date field. An unauthenticated, remote attacker can exploit thi...