[SECURITY] Fedora 15 Update: nginx-1.0.14-1.fc15

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

mutt-devel -- failure to check SMTP TLS server certificate

Dave B reports on Full Disclosure: It seems that mutt fails to check the validity of a SMTP servers certificate during a TLS connection. ... This means that an attacker could potentially MITM a mutt user connecting to their SMTP server even when the user has forced a TLS connection...

Fork CMS 3.2.x - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Fork CMS 3.2.x - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/52319/info Fork CMS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits...

Service Detection : SMTP Server on a Well-Known Port

This plugin attempts to collect the banner from services listening on well-known SMTP ports. It is not expected to report anything. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid57914; scriptversion"$Revision: 2.4 $"; scriptcvsdate"$Date: 2013/02/17 01:24:57 $";...

OS Identification : SMTP

Nessus was able to identify the remote operating system based on the banner reported by the mail server running on it. C Tenable, Inc. include"compat.inc"; if description scriptid57915; scriptversion"2.38"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/03/31";...

Backported Security Patch Detection (SMTP)

Security patches may have been 'backported' to the remote SMTP server without changing its version number. Banner-based checks have been disabled to avoid false positives. Note that this test is informational only and does not denote any security problem. C Tenable Network Security, Inc...

Windows Gather Microsoft Outlook Saved Password Extraction

This module extracts and decrypts saved Microsoft Outlook versions 2002-2010 passwords from the Windows Registry for POP3/IMAP/SMTP/HTTP accounts. In order for decryption to be successful, this module must be executed under the same privileges as the user which originally encrypted the password. ...

[SECURITY] Fedora 16 Update: curl-7.21.7-6.fc16

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

CURL-CVE-2012-0036 URL sanitization vulnerability

curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs. When parsing URLs, libcurl's parser is liberal and only parses as little as possible and lets as much as possible through as long as it can figure out what to do. In...

CVE-2012-0036

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

PT-2012-1100

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.24.0 Description The issue concerns the improper handling of special characters during pathname extraction from URLs, allowing remote attackers to conduct data-injection attacks. This can be exploited through crafted...

SMTP Proxy Traffic Detected

Binary data 6231.prm...

FTP Client Initiated from an SMTP Server

Binary data 6246.prm...

spamdyke -- STARTTLS Plaintext Injection Vulnerability

Secunia reports: The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data e.g. SMTP commands during the...

Ubuntu Update for python3.1 USN-1314-1

Ubuntu Update for Linux kernel vulnerabilities USN-1314-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13141.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for python3.1 USN-1314-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net Th...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

Sql injection

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4554

CVE-2011-4554 concerns the project’s One Click Orgs software (before version 1.2.3). The issue arises from input handling in org names (and in email addresses) that allows crafting SMTP traffic via the characters “ (double quote) and newline, and via quotes in email addresses. This is described a...

CVE-2011-4554: Improper Input Validation

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...