SOGo security vulnerabilities

SOGo is a very fast and extensible modern collaboration suite from Alinto Open Source. It provides calendaring, address book management and a full-featured webmail client as well as resource sharing and permission handling. A security vulnerability exists in SOGo versions prior to 5.10.0 that ste...

PT-2024-20429 · Alinto +1 · Alinto Sogo +1

Name of the Vulnerable Software and Affected Versions: Alinto SOGo versions prior to 5.10.0 Description: A Cross Site Scripting issue exists in Alinto SOGo, allowing a remote attacker to execute arbitrary code via the import function to the mail component. This can be exploited by a remote...

CVE-2024-24510

Alinto SOGo versions prior to 5.10.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the mail component . This vulnerability allows a remote attacker to execute arbitrary code by leveraging the import function . To remediate this issue, users should update to version 5.10.0 or later. As a ...

CVE-2024-24510: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component...

CVE-2024-24510

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component...

AZL-69869 CVE-2024-25584 affecting package dovecot 2.3.20-1

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

UBUNTU-CVE-2024-25584

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

CVE-2024-25584: Insufficient Verification of Data Authenticity

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

Dovecot security vulnerabilities

Dovecot is Dovecot Open Source an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A security vulnerability exists in Dovecot that stems from a non-RFC-compliant recognition of the DATA command end symbol, which causes a single message containing the LF DOT LF to be...

PT-2024-21020 · Dovecot · Dovecot

Name of the Vulnerable Software and Affected Versions: Dovecot affected versions not specified Description: The issue arises because Dovecot accepts the dot LF DOT LF symbol as the end of the DATA command, whereas the RFC requires it to be CR LF DOT CR LF. This discrepancy causes Dovecot to split...

Joomla! 3.x < 3.10.17 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.17, 4.x prior to 4.4.7 or 5.x prior to 5.1.3. It is, therefore, affected by multiple vulnerabilities. - The stripImages and stripIframes methods didn't properly process inputs,...

Joomla! 5.x < 5.1.3 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.17, 4.x prior to 4.4.7 or 5.x prior to 5.1.3. It is, therefore, affected by multiple vulnerabilities. - The stripImages and stripIframes methods didn't properly process inputs,...

EulerOS Virtualization 2.12.1 : emacs (EulerOS-SA-2024-2303)

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.CVE-2024-30205 I...

Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2024-2303)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SMTP Open Relay Detection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMTP Open Relay Detection', 'Description' = %q This module tests if an SMTP server will accept via a code 250 an e-mail by using a variation of...

Postfixadmin Protected Alias Deletion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postfixadmin Protected Alias Deletion Vulnerability', 'Description' = %q Postfixadmin installations between 2.91 and 3.0.1 do not check if an adm...

Dovecot DoS

The vulnerability of the Dovecot mail server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to perform a denial-of-service attack...

PT-2024-31490 · Typo3 · Powermail

Name of the Vulnerable Software and Affected Versions: powermail extension versions prior to 7.5.0 powermail extension versions prior to 8.5.0 powermail extension versions prior to 10.9.0 powermail extension versions prior to 12.4.0 Description: An issue was discovered in the powermail extension...

ROS-20240826-17

Vulnerability in DecodeConfig component of Golang programming language is related to uncontrolled consumption of resources. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial-of-service condition. denial of service Vulnerability of...

UBUNTU-CVE-2024-23185

Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no si...