Design/Logic Flaw

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...

CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...

CVE-2024-28186

CVE-2024-28186 affects FreeScout (PHP). The root cause is that the application stores complete stack traces in its database, which are exposed to users via the endpoint /conversation/ajax-html/send_log?folder_id=&thread_id={id}. The stack traces reveal sensitive data, including the username and p...

CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...

CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...

PT-2024-21808

Name of the Vulnerable Software and Affected Versions aiosmtpd versions prior to 1.4.5 Description aiosmtpd is vulnerable to inbound SMTP smuggling, a novel vulnerability based on interpretation differences of the SMTP protocol. By exploiting this issue, an attacker may send spoofed e-mails with...

CVE-2024-27938

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from ...

Code injection

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from ...

CVE-2024-27938 SMTP Smuggling in Postal

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from ...

CVE-2024-27938

CVE-2024-27938 concerns Postal, an open source SMTP server. The vulnerability affects Postal versions older than 3.0.0 and enables SMTP Smuggling, potentially allowing an incoming email to be spoofed as if sent from a server the recipient user authorized. The impact is limited to inbound mail flo...

CVE-2024-27938 SMTP Smuggling in Postal

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from ...

CVE-2024-27938 SMTP Smuggling in Postal

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from ...

Swift SMTP < 5.0.7 - Cross-Site Request Forgery

Description The Swift SMTP formerly Welcome Email Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.6. This is due to missing or incorrect nonce validation on the ajaxhandler function. This makes it possible for unauthenticated...

openSUSE Security Advisory (SUSE-SU-2024:0743-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: apache-commons-net-3.10.0-5.fc40

This is an Internet protocol suite Java library originally developed by ORO, Inc. This version supports Finger, Whois, TFTP, Telnet, POP3, FTP, NNTP, SMTP, and some miscellaneous protocols like Time and Echo as well as BSD R command support. The purpose of the library is to provide fundamental...

SUSE SLES12 Security Update : sendmail (SUSE-SU-2024:0742-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0742-1 advisory. - CVE-2023-51765: Fixed new SMTP smuggling attack. bsc1218351 Tenable has extracted the preceding description block directly from the SUSE...

BIT-ROUNDCUBE-2020-18671

Cross Site Scripting XSS vulnerability in Roundcube Mail =1.4.4 via smtp config in /installer/test.php...

BIT-DISCOURSE-2022-46168 Group SMTP user emails are exposed in CC email header

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta15 on the beta and tests-passed branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is n...

BIT-GRAFANA-2023-2183

Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access t...

SUSE SLED15: libmilter-doc / libmilter1_0 / rmail / sendmail / sendmail-devel / etc (SUSE-SU-2024:0743-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0743-1 advisory. - CVE-2023-51765: Fixed new SMTP smuggling attack. bsc1218351 Tenable has extracted the preceding...