Man-in-the-middle in Jira email client - CVE-2020-14168

The email client in Jira Server and Data Center allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle MITM vulnerability Affected versions: version 7.13.14 8.5.0 ≤ version 8.5.5 8.8.0 ≤ version 8.8.2 8.9.0 ≤ version 8.9.1 Fixed version...

Open-Xchange: Buffer over read from `smtp_command_parse_parameters`

Function smtpcommandparseparameters calls uniutf8getcharn with length parameter sizetp - parser-endwhen the parameter should be sizetparser-end - p To reproduce, send as input to the smtp server 8191 spaces followed by the beginning of one unicode character printf ' %8190s\xdc' " " | nc localhost...

dovecot:fuzz-smtp-server: Heap-buffer-overflow in smtp_command_parse_line

Project: https://github.com/dovecot/core.git Detailed Report: https://oss-fuzz.com/testcase?key=6020231943421952 Project: dovecot Fuzzing Engine: afl Fuzz Target: fuzz-smtp-server Job Type: aflasandovecot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000007100 Cra...

dovecot:fuzz-smtp-server: Heap-buffer-overflow in uni_utf8_get_char_n

Project: https://github.com/dovecot/core.git Detailed Report: https://oss-fuzz.com/testcase?key=5271279639986176 Project: dovecot Fuzzing Engine: afl Fuzz Target: fuzz-smtp-server Job Type: aflasandovecot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000009900 Cra...

Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure

All issues are associated with Castel NextGen DVR v1.0.0 and have been resolved in v1.0.1. ------------------------------- CVE-2020-11679 Original Disclosure https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass Description A low privileged user can call functionality...

Default credentials

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...

keycloak: improper verification of certificate with host mismatch could result in information disclosure

A flaw was found in Keycloak, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack...

keycloak: improper verification of certificate with host mismatch could result in information disclosure

A flaw was found in Keycloak, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack...

CVE-2019-19215

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server...

Buffer overflow

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server...

CVE-2019-19215

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server...

Open-Xchange: Null pointer dereference in SMTP server function smtp_command_parse_data_with_size

Sending the following bytes to the SMTP server induces a NULL pointer dereference...

Open-Xchange: Null pointer dereference in SMTP server function smtp_string_parse

Sending the following bytes to the SMTP server induces a NULL pointer dereference...

Open-Xchange: Use after free in smtp_server_connection_handle_command

Function smtpserverconnectionhandlecommand in src/lib-smtp/smtp-server-connection.c creates a variable named cmd with cmd = smtpservercommandnewtmpconn, cmdname, cmdparams; It gets used with return cmd == NULL || !cmd-inputlocked; ie cmd-inputlocked dereferences the pointer But we can get to this...

Debian: Security Advisory (DSA-4634-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Command Execution Vulnerability Exists in OpenSMTPD's

OpenSMTPD is a free implementation of the server-side SMTP protocol , and provides some additional standard extensions . OpenSMTPD's suffers from a command execution vulnerability. An attacker can execute arbitrary shell commands on a vulnerable OpenSMTPD installation...

Apache James Server 2.3.2 Insecure User Creation / Arbitrary File Write

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write", 'Description' = %q This module exploits a vulnerability that exists due t...

Debian: Security Advisory (DSA-4611-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2020:0045-1)

This update for git fixes the following issues : Security issues fixed : CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice bsc1158787. CVE-2019-19604: Fixed a recursive clone...

graphite.composer.views.send_email vulnerable to SSRF

Impact sendemail in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and the...