MyBB < 1.8.31 RCE Vulnerability (GHSA-hxhm-rq9f-7xj7)

MyBB is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

mail.hydraulics2000.com.au Cross Site Scripting vulnerability OBB-2982849

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Microsoft Exchange Server Elevation of Privilege Vulnerability (CNVD-2022-67837)

Microsoft Exchange Server is a popular mail service program developed by Microsoft. Microsoft Exchange Server is vulnerable to an elevation of privilege vulnerability, which can be exploited by remote attackers to submit special requests that can obtain sensitive information or elevate privileges...

CVE-2022-39265

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

Double free

MyBB is a free and open source forum software. The Mail Settings ? Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

PT-2022-24855 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.31 Description: The issue in MyBB allows access to sensitive information and Remote Code Execution RCE through the mail parameters setting value in the Mail Settings → Additional Parameters for PHP's mail function, ...

CVE-2022-39265

CVE-2022-39265 affects MyBB prior to 1.8.31. The vulnerability arises from the Mail Settings → Additional Parameters for PHP’s mail() function, where the mail_parameters setting, in combination with the configured mail program’s options, can expose sensitive information and enable Remote Code Exe...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

MyBB 注入漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, and is extensible.MyBB is vulnerable to a command injection vulnerability that originates from the additional parameter Mail Settings ?...

PT-2022-37523 · Sendmail · Sendmail

Name of the Vulnerable Software and Affected Versions: sendmail affected versions not specified Description: The issue is related to SMTP session reuse, which can lead to STARTTLS not being used even if it is offered. Recommendations: At the moment, there is no information about a newer version...

[SECURITY] Fedora 37 Update: thunderbird-102.3.1-1.fc37

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 36 Update: thunderbird-102.3.1-1.fc36

Mozilla Thunderbird is a standalone mail and newsgroup client...

No rate limit on email triggering during "resend email" action results in email flooding or a spam attack or a financial loss to the company itself

Description When a user is setting up 2FA , a verification code will be sent to the registered email . There is no rate limit on email triggering that will result in an email flood / does attack or will also increase the expenses on your mail server as an attacker can send 1 million emails throug...

Researchers Uncover Covert Attack Campaign Targeting Military Contractors

A new covert attack campaign singled out multiple military and weapons contractor companies with spear-phishing emails to trigger a multi-stage infection process designed to deploy an unknown payload on compromised machines. The highly-targeted intrusions, dubbed STEEPMAVERICK by Securonix, also...

mailcow redirect vulnerability

mailcow is a mail server suite. mailcow versions prior to 2022.09 contain a redirection vulnerability, which stems from the system's failure to reasonably handle target hops. An attacker could exploit the vulnerability by crafting a custom Swagger API template to spoof authorization links and...

Cross site scripting

Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the e-mail template modules...

CVE-2022-39258

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to stea...

CVE-2022-39258 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to stea...