SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

Nylas Mail Lives Information Disclosure Vulnerability

Nylas Mail Lives is an open source, extensible desktop mail application. A security vulnerability exists in Nylas Mail Lives version 2.2.2, which stems from the program assigning 0755 privileges to $HOME/.nylas-mail. A local attacker can exploit the vulnerability to obtain sensitive authenticatio...

TYPO3 Direct Mail Extended Authentication Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. direct Mail is one of the extensions to send mail without the need for SMTP servers . An authentication bypass vulnerability exists in the TYPO3 Direct Mail extension. An attacke...

Unspecified Vulnerability in Apple iOS Mail Message Framework

Apple iOS is an operating system developed by Apple for mobile devices, and Mail Message Framework is one of the components of the e-mail message framework. A security vulnerability exists in the Mail Message Framework component of Apple iOS. The vulnerability can be exploited by a remote attacke...

Authentication flaw

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

CVE-2017-1000485 affects Nylas Mail Lives 2.2.2. The root cause is that the application assigns 0755 permissions to the directory "$HOME/.nylas-mail", enabling local users to read sensitive authentication data via standard filesystem operations. The reports in multiple sources confirm this disclo...

Updated emacs packages fix security vulnerability

Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code execution when rendering text/enriched MIME data e.g. when using Emacs-based mail clients CVE-2017-14482...

CVE-2016-10704

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

Session fixation

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

CVE-2016-10704

CVE-2016-10704 affects Magento Community Edition and Enterprise Edition before versions 2.0.10 (CE) and 2.1.x before 2.1.2. The issue is an XSS in email templates that is mishandled during preview (APPSEC-1503). Root cause: crafted input in email template preview can be reflected in rendered cont...

mail.57fb.com XSS vulnerability

Open Bug Bounty ID: OBB-466926 Description| Value ---|--- Affected Website:| mail.57fb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2013-7400

The Direct Mail directmail extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes...

Authentication flaw

The Direct Mail directmail extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes...

CVE-2013-7400

The Direct Mail directmail extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes...

CVE-2013-7400

The CVE-2013-7400 entry applies to the TYPO3 Direct Mail extension (direct_mail) prior to version 3.1.2, where authentication codes were not checked correctly, allowing remote attackers to obtain sensitive information. Public sources in connected documents confirm an information-disclosure vulner...

CVE-2017-7152

An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail Message Framework" component. It allows remote attackers to spoof the address bar via a crafted web site...

CVE-2017-7152

An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail Message Framework" component. It allows remote attackers to spoof the address bar via a crafted web site...