CVE-2025-40752

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configure...

CVE-2025-40752

CVE-2025-40752 affects Siemens POWER METER SICAM Q100/Q200 (Q100 variants 2.60–2.61/2.60–2.61 for certain SKUs) and SICAM Q200 (2.70–2.79) where SMTP password is stored in cleartext. This allows an authenticated local attacker to read the SMTP credentials from the device configuration and abuse t...

Siemens POWER METER SICAM Q100和Siemens POWER METER SICAM Q200 安全漏洞

Siemens POWER METER SICAM Q100 and Siemens POWER METER SICAM Q200 are multifunctional power quality recorders from Siemens, Germany. A security vulnerability exists in Siemens POWER METER SICAM Q100 and Siemens POWER METER SICAM Q200 versions prior to V2.62, which stems from a plaintext export of...

PT-2025-32655 · Siemens · Sicam Q100 +1

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions 2.60 through 2.61 POWER METER SICAM Q200 versions 2.70 through 2.79 Description: Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extra...

Linux Distros Unpatched Vulnerability : CVE-2025-5986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without promptin...

BIT-LIBPYTHON-2025-1795 Mishandling of comma during folding and unicode-encoding of email headers

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted...

A week in security (August 4 – August 10)

Last week on Malwarebytes Labs: Adult sites trick users into Liking Facebook posts using a clickjack Trojan Facebook users targeted in ‘login’ phish TeaOnHer, the male version of Tea, is leaking personal information on its users too How Google, Adidas, and more were breached in a Salesforce scam...

Security update for zabbix

This update for zabbix fixes the following issues: CVE-2024-42333: Fixed buffer over-read for broken UTF8 mail data injection. bsc1233834 CVE-2024-22117: Fixed a bug that can cause the map element to crash when new URLs are added. bsc1233791 Patch Instructions: To install this SUSE update use the...

SUSE-SU-2025:02746-1 Security update for zabbix

This update for zabbix fixes the following issues: - CVE-2024-42333: Fixed buffer over-read for broken UTF8 mail data injection. bsc1233834 - CVE-2024-22117: Fixed a bug that can cause the map element to crash when new URLs are added. bsc1233791...

Active! Mail < 6.60.05008562 Remote Code Execution

According to its banner, the version of Active! Mail running on the remote host is 6.60.05008562. It is, therefore, affected by a Remote Code Execution through a a stack-based buffer overflow vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the...

Linux Distros Unpatched Vulnerability : CVE-2020-22402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting XSS vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing...

CVE-2025-24000

Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through = 3.2.0...

Linux Distros Unpatched Vulnerability : CVE-2019-10732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts...

OESA-2025-1987 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

OESA-2025-1988 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

OESA-2025-1989 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

OESA-2025-1990 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

OESA-2025-1991 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

Important: jakarta-mail

Issue Overview: In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. CVE-2025-7962 Affected Packages: jakarta-mail Issue Correction: Run dnf update jakarta-mail --releasever 2023.8.20250808 or dnf update...

CVE-2012-10046: Improper Neutralization of Special Elements used in an OS Command

The E-Mail Security Virtual Appliance ESVA tested on version ESVA2057 contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands...