CVE-2021-29281

File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317...

CVE-2021-29281

CVE-2021-29281 is a file-upload vulnerability in GFI Mail Archiver prior to or up to v15.1 caused by insecure use of the Telerik Web UI plugin, tying to CVE-2014-2217 and CVE-2017-11317. The vulnerability enables arbitrary file uploads/execution via the Telerik UI for ASP.NET AJAX file upload iss...

Phishing Attack

next-auth is vulnerable to phishing attacks. A remote attacker is able to pass a specifically crafted input to the e-mail signin endpoint which contains malicious HTML, tricking the e-mail server to send it to the user which allows the attacker to perform phishing attacks on the victim...

GFI Mail Archiver 代码问题漏洞

GFI Mail Archiver is used by GFI Malta to easily protect, store and retrieve electronic communications. A security vulnerability exists in GFI Mail Archiver version 15.1, which stems from the insecure use of the Telerik Web UI plugin affected by CVE-2014-2217 and CVE-2017-11317, which can be...

CVE-2022-31131

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended...

Design/Logic Flaw

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended...

Hardcoded credentials

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

CVE-2022-31127 Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended...

CVE-2022-31131

CVE-2022-31131 affects Nextcloud Mail prior to version 1.12.2, where tasks related to mail attachments lack proper user ownership checks. This could allow attachments to be exposed to or manipulated by incorrect system users when updating or deleting entries in oc_mail_attachments. Impact is desc...

CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended...

CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended...

Ownership check missing when updating or deleting mail attachments

None...

[SECURITY] Fedora 35 Update: thunderbird-91.11.0-1.fc35

Mozilla Thunderbird is a standalone mail and newsgroup client...

PT-2022-20551 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud mail versions prior to 1.12.2 Description: The issue concerns missing user account ownership checks when performing tasks related to mail attachments in Nextcloud mail, potentially exposing attachments to incorrect system users...

Improper access control

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through...

Nextcloud 注入漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an injection vulnerability that stems from susceptibility to SMTP command injection attacks...

PT-2022-20459 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions prior to 22.2.8 Nextcloud server versions prior to 23.0.5 Nextcloud server versions prior to 24.0.1 Description: The Nextcloud server is an open source personal cloud server. Affected versions were found to be...

[SECURITY] Fedora 35 Update: python-twisted-22.4.0-1.fc35

Twisted is a networking engine written in Python, supporting numerous protoco ls. It contains a web server, numerous chat clients, chat servers, mail servers and more...

[SECURITY] Fedora 36 Update: python-twisted-22.4.0-1.fc36

Twisted is a networking engine written in Python, supporting numerous protoco ls. It contains a web server, numerous chat clients, chat servers, mail servers and more...