Barracuda Networks MDM - Persistent Mail Vulnerability

Document Title: =============== Barracuda Networks MDM - Persistent Mail Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1315 Release Date: ============= 2016-02-04 Vulnerability Laboratory ID VL-ID: ==================================== 131...

Barracuda Networks SN #52 - Persistent Web Vulnerability

Document Title: =============== Barracuda Networks SN 52 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1297 BNSEC ID: 0004001004 Tracking ID: CAS-03491-K1X2V0 Release Date: ============= 2016-02-03 Vulnerability Laborator...

DEBIAN-CVE-2015-8793

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937...

UBUNTU-CVE-2015-8793

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937...

SA110 : Java Deserialization Vulnerabilities

SUMMARY Blue Coat products that deserialize unsafe Java objects from untrusted sources are susceptible to one or more vulnerabilities. A remote attacker can exploit these vulnerabilities to cause the target to execute arbitrary code. AFFECTED PRODUCTS Cloud Data Protection for Salesforce CDP-SFDC...

eBay Magento Persistent Mail Encoding

Document Title: =============== Ebay Magento Bug Bounty 2 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1203 eBay Inc. Bug Bounty Program ID: EIBBP-26644 Release Date: ============= 2016-01-18 Vulnerability Laboratory ID...

SUSE-SU-2016:0267-1 Security update for rubygem-mail-2_4

This update for rubygem-mail-24 fixes the following issues: bsc959129: SMTP Injection via recipient email addresses...

HackerOne: Unintended HTML inclusion as a result of https://hackerone.com/reports/110578

Hi, I was just reading https://hackerone.com/reports/110578 and testing out the changes. I had previously noticed that the editor would take something like: test and turn it into : test In other words, the code would recursively look at what should be the title string and use the first single or...

openSUSE Security Update : rubygem-mail / rubygem-mail-2_4 / rubygem-mail-2_5 (openSUSE-2016-15)

This update for rubygem-mail, rubygem-mail-24, rubygem-mail-25 fixes the following security issues : - boo959129: SMTP Injection via recipient email addresses %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

Debian DSA-3452-1 : claws-mail - security update

'DrWhax' of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] [DSA 3452-1] claws-mail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3452-1 [email protected] https://www.debian.org/security/ Ben Hutchings January 23, 2016 https://www.debian.org/security/faq -...

DSA-3452-1 claws-mail - security update

Bulletin has no description...

Debian Security Advisory DSA 3452-1 (claws-mail - security update)

DrWhax of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail. OpenVAS Vulnerability Test $Id: deb3452.nasl...

Debian: Security Advisory (DSA-3452-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

dgmcwhzf.com XSS vulnerability

Vulnerable URL: http://www.dgmcwhzf.com/ts/MailShow.asp?deptname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:34 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

U-Mail V9.8.57 /fast/default/operates.php 任意用户登录及注入漏洞

No description provided by source...

Yahoo repair mailbox vulnerability, the researchers receive a million dollar bonus-vulnerability warning-the black bar safety net

! Currently Yahoo repair a can be attacker for hijacking the user's mailbox vulnerability. The vulnerability is hazards heavier According to the latest news that Yahoo has to fix theXSSvulnerabilities, earlier, a malicious attacker can exploit the vulnerability to send malicious mail, then you ca...

FreeBSD : claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc (51358314-bec8-11e5-82cd-bcaec524bf84)

DrWhax reports : So in codeconv.c there is a function for Japanese character set conversion called convjistoeuc. There is no bounds checking on the output buffer, which is created on the stack with alloca Bug can be triggered by sending an email to [email protected] or whatever. Since my C is...

Critical Yahoo Mail Flaw Patched, $10K Bounty Paid

A critical vulnerability in Yahoo Mail that could give attackers complete control of an account was patched two weeks ago. The flaw was privately disclosed Dec. 26 by Finnish researcher Jouko Pynnonen and patched Jan. 6. Pynnonen earned himself a $10,000 bounty, one of the highest paid out by Yah...

Stack overflow

Stack-based buffer overflow in the pharfixfilepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling...