56 matches found
OrangeHRM Arbitrary Command Injection Vulnerability
OrangeHRM is a human resource management system HRM from OrangeHRM, Inc. in the United States. The system supports personnel information management, leave management, attendance management and recruitment management. A command injection vulnerability exists in admin/listMailConfiguration in...
IPFire 2.21 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: IPFire 2.21 - Core Update 127 | Cross-Site Scripting Exploit Author: Ozer Goker Vendor Homepage: https://www.ipfire.org Software Link:...
How to attach files in Secure Mail keeping the policy restricted
In Secure Mail/WorxMail versions 10.3.5 and later, Android users can't attach images directly from the Gallery app when the Inbound document exchange Open-in policy is set to Restricted. If you want to keep this policy set to Restricted but still allow users to add photos from the Gallery, follow...
XSS in Mail Whitelist Field
Jira Admins can create a persistant XSS on the Incoming Mail configuration page. When the value code "alert1 code is inserted into the Witelisted Domain field on the page code /secure/admin/IncomingMailServers.jspa code The javascript persists and executes on page load. This was tested on Jira...
Sinapsi eSolar Light Plaintext Password Disclosure Vulnerability
Sinapsi eSolar Light is a monitoring system for use within solar applications from the Italian company Sinapsi. A security vulnerability in Sinapsi eSolar Light allows a remote attacker to read the HTML source code in the mail-configuration page to obtain a clear-text password and use it for...
CVE-2015-3949
Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...
Code injection
Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...
CVE-2015-3949
Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...
CVE-2014-8839
Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e-mail message and logging HTTP requests for this image's URL...
How To Setup Postfix
How To Setup Postfix Postfix is a very popular open source Mail Transfer Agent MTA that can be used to route and deliver email on a Linux system. It is estimated that around 25% of public mail servers on the internet run Postfix. In this guide, we’ll teach you how to get up and running quickly wi...
Phabricator: Abusing daemon logs for Privilege escalation under certain scenarios
Setup Needed + A normal user account + A momentary disruption of mail services Replication steps + Login as normal user + Wait for momentary disruption of mail services + Use Password Reset Link for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of...
PHP 5.2.4 mail.force_extra_parameters unsecure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.2.4 mail.forceextraparameters unsecure Author: Maksymilian Arciemowicz cXIb8O3 SecurityReason Date: - - Written: 06.09.2007 - - Public: 0x.0x.2007 SecurityReason Research SecurityAlert Id: 47 CVE: CVE-2007-3378 SecurityRisk: Medium Affected...
Solaris LPD Command Execution
This module exploits an arbitrary command execution flaw in the in.lpd service shipped with all versions of Sun Solaris up to and including 8.0. This module uses a technique discovered by Dino Dai Zovi to exploit the flaw without needing to know the resolved name of the attacking system. This...
Sendmail DEBUG Mode Leak Vulnerability
According to the version number of the remote mail server, a local user may be able to obtain the complete mail configuration and other interesting information about the mail queue. SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and...
Sendmail RestrictQueueRun Option Debug Mode Information Disclosure
According to the version number of the remote mail server, a local user may be able to obtain the complete mail configuration and other interesting information about the mail queue even if he is not allowed to access those information directly, by running sendmail -q -d0-nnnn.xxx where nnnn & xxx...