15559 matches found
Sql injection
SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...
CVE-2014-8809
Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...
Lotus Mail Encryption Server (Protector for Mail) LFI to RCE Exploit
Exploit for php platform in category remote exploits $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core...
Lotus Mail Encryption Server 2.1.0.1 (Protector for Mail) - Local File Inclusion Remote Code Execution (Metasploit)
Lotus Mail Encryption Server 2.1.0.1 Protector for Mail - Local File Inclusion Remote Code Execution Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing...
sendmail: Information disclosure
Background sendmail is a widely-used Mail Transport Agent MTA. Description The smcloseonexec function in conf.c has arguments in the wrong order. Impact A local attacker could get access to unintended high-numbered file descriptors via a specially crafted program. Workaround There is no known...
Lotus Mail Encryption Server 2.1.0.1 (Protector for Mail) - Local File Inclusion / Remote Code Execution (Metasploit)
$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Lotus Mail Encryption Server...
[SECURITY] [DSA 3091-1] getmail4 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3091-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano December 07, 2014 http://www.debian.org/security/faq -...
Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion
$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Lotus Mail Encryption Server...
MGASA-2014-0531 Updated claws-mail packages fix security vulnerability
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service crash via a crafted TNEF file, which triggers a buffer overflow CVE-2010-5109. The claws-mail package contains an embedded copf of libytnef, which has been...
Updated claws-mail packages fix security vulnerability
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service crash via a crafted TNEF file, which triggers a buffer overflow CVE-2010-5109. The claws-mail package contains an embedded copf of libytnef, which has been...
CentOS 6 / 7 : mailx (CESA-2014:1999)
Updated mailx packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...
Debian DSA-3104-1 : bsd-mailx - security update
It was discovered that bsd-mailx, an implementation of the 'mail' command, had an undocumented feature which treats syntactically valid email addresses as shell commands to execute. Users who need this feature can re-enable it using the 'expandaddr' in an appropriate mailrc file. This update also...
Debian DSA-3105-1 : heirloom-mailx - security update
Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the 'mail' command : - CVE-2004-2771 mailx interprets shell meta-characters in certain email addresses. - CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell commands ...
[SECURITY] [DSA 3104-1] bsd-mailx security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3104-1 [email protected] http://www.debian.org/security/ Florian Weimer December 16, 2014 http://www.debian.org/security/faq -...
RelateIQ Mail Encoding Script Code Injection
Document Title: =============== RelateIQ Bug Bounty 1 - Persistent Signup Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1320 Video: http://www.vulnerability-lab.com/getcontent.php?id=1332 Release Date: ============= 2014-12-02 Vulnerabili...
Debian Security Advisory DSA 3105-1 (heirloom-mailx - security update)
Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the mail command: CVE-2004-2771 mailx interprets interprets shell meta-characters in certain email addresses. CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell...
Multiple vulnerabilities in Drag Drop Mass Upload (ameos_dragndropupload)
It has been discovered that the extension "Drag Drop Mass Upload" ameosdragndropupload is susceptible to Cross-Site Scripting, Cross-Site Request Forgery and Improper Access Control. Release Date: December 15, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3...
WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload
WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload !/usr/bin/python Exploit Name: Wordpress WP Symposium 14.11 Shell Upload Vulnerability Vulnerability discovered by Claudio Viviani Exploit written by Claudio Viviani 2014-11-27: Discovered vulnerability 2014-12-01: Vendor Notification...
GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011
The remote host is affected by the vulnerability described in GLSA-201412-09 Multiple packages, Multiple vulnerabilities fixed in 2011 Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. FMOD Studio PEAR Mail...