131 matches found
OpenSMTPD Vulnerability
The CERT Coordination Center CERT/CC has released information on a vulnerability affecting OpenSMTPD. An attacker could exploit this vulnerability to take control of an affected system. OpenSMTPD is an open-source server-side implementation of the Simple Mail Transfer Protocol SMTP that is part o...
curl: SMTP end-of-response out-of-bounds read
An out-of-bounds read flaw was found in the way curl handled certain SMTP responses. A remote attacker could use this flaw to crash curl...
Phorpiex Botnet Shifts Gears From Ransomware to Sextortion
A recent wide-scale campaign indicates that a decade-old botnet is shifting gears from distributing ransomware to delivering millions of sextortion threats to innocent recipients. Worse, researchers say that the botnet’s spam campaign can affect up to 27 million potential victims. The botnet,...
Critical Exim Flaw Opens Millions of Servers to Takeover
UPDATE Researchers are urging users to upgrade their Exim servers immediately after millions of servers were found to be vulnerable to a critical flaw that could allow a remote, unauthenticated attacker to take full control of them. Exim, which is free software used on Unix-like operating systems...
curl: SMTP end-of-response out-of-bounds read
An out-of-bounds read flaw was found in the way curl handled certain SMTP responses. A remote attacker could use this flaw to crash curl...
The vulnerability of the libcurl library, related to reading beyond the buffer boundaries of memory, allows an attacker to cause a service failure.
The vulnerability of the libcurl library relates to reading data beyond the buffer boundaries for SMTP communication. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
ALPINE-CVE-2019-3823
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtpendofresp isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol call rea...
Synametrics SynaMan Information Disclosure Vulnerability
Synametrics SynaMan is a remote file manager from Synametrics Technologies, USA. An information disclosure vulnerability exists in Synametrics SynaMan version 4.0 build 1488, which stems from the program storing passwords for smtp email accounts in plaintext, which can be exploited by an attacker...
curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP
A heap-based buffer overflow has been found in the Curlsmtpescapeeob function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory...
ALPINE-CVE-2018-0500
Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE...
CVE-2016-1000282
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/haraka.py 2019-02-05 20:22:28+00:00| seen| https://t.me/cibsecurity/2401...
Dovecot Read Across Boundaries Vulnerability Vulnerability
Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . An out-of-bounds read vulnerability exists in Dovecot version 2.2.33.2. An attacker can exploit this vulnerability to cause a denial of service and obtain sensitive information by sending specially crafted emai...
SMTP credential vulnerability in multiple HP products
HP DesignJet T790 and others are printer devices from Hewlett-Packard HP in the United States. An SMTP credential vulnerability exists in several HP products. An attacker can exploit this vulnerability to obtain credentials for an SMTP server...
OpenJDK: newline injection in the SMTP client (Networking, 8171533)
A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application...
DEBIAN-CVE-2017-16944
The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the...
CVE-2017-2845
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests...
OpenJDK: newline injection in the SMTP client (Networking, 8171533)
A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application...
SysGauge Buffer Overflow Vulnerability
SysGauge is a free system and performance monitoring utility. SysGauge suffers from a buffer overflow vulnerability. It allows an attack vector to send a long 220 also known as "service ready" string via a crafted SMTP daemon...
The vulnerability of Cisco Nexus 7000 software allows a malicious actor to trigger buffer overflows.
The buffer overflow in the implementation of the Smart Call Home function in Cisco NX-OS for Cisco Unified Computing System UCS switches and Nexus devices, as well as in Cisco CG-OS for Cisco Connected Grid series 1000 routers, allows remote SMTP servers to execute arbitrary code using specially...
UBUNTU-CVE-2014-3556
The STARTTLS implementation in mail/ngxmailsmtphandler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command...