Postfix Data Forgery Issue Vulnerability

Postfix is an open source mail transfer agent. A security vulnerability exists in Postfix version 2.10.1-7. An attacker can exploit the vulnerability to send mail by spoofing the sender...

CVE-2020-12063

A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/senderlogin feature is used, because a spoofe...

CVE-2020-12063

The CVE-2020-12063 issue affects Postfix 2.10.1-7 and enables spoofed outbound mail via a homoglyph attack (30F) that resembles a configured sender when /etc/postfix/sender_login is used. Multiple connected sources (SUSE, Red Hat, UB Ubuntu/BPO feeds) confirm that an attacker could send mail fr...

PT-2020-13021 · Postfix · Postfix

Name of the Vulnerable Software and Affected Versions: Postfix version 2.10.1-7 Description: The issue allows an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of xcexbf to the 'o' character. This is potentially relevant when t...

Air Sender v1.0.2 iOS - Arbitrary File Upload Vulnerability

Document Title: =============== Air Sender v1.0.2 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2212 Release Date: ============= 2020-04-23 Vulnerability Laboratory ID VL-ID: ==================================...

OS Command Injection

node-key-sender is vulnerable to OS command injection. The vulnerability exists through the unsanitized value of arrParams used in exec...

node-key-sender command injection vulnerability

node-key-sender is a module that sends keyboard events to the operating system. A command injection vulnerability exists in node-key-sender 1.0.11 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands via the 'arrParams' parameter in the 'execute' function...

CVE-2020-7627

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...

CVE-2020-7627

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...

Command injection

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...

CVE-2020-7627

The CVE refers to the npm module node-key-sender (versions up to 1.0.11 and earlier). The root cause is a Command Injection in the function that uses the arrParams argument of the execute() method, allowing execution of arbitrary commands. Multiple connected sources (Red Hat, Snyk, Veracode, CNVD...

CVE-2020-7627

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...

@bionicmetrics/bionic (>=1.2.0, <=1.3.6), @emonxdefine/oindot (>=1.0.3, <=1.0.7) +9 more potentially affected by CVE-2020-7627 via node-key-sender (>=1.0.9, <=1.0.11)

node-key-sender NPM version =1.0.9, =1.2.0, =1.0.3, =1.0.9, =1.5.0, =0.0.1, =1.0.0, =1.0.5, =0.9.0, =1.2.1, =1.1.0, =2.2.0 Source cves: CVE-2020-7627 Source advisory: SNYK:JS-NODEKEYSENDER-564261...

Command Injection

Overview node-key-sender is a module that send keyboard events to the operational system. Affected versions of this package are vulnerable to Command Injection. The argument arrParams in function execute can be controlled by users without any sanitization. PoC var root = require"node-key-sender";...

Moderate: Red Hat Security Advisory: rsyslog security, bug fix, and enhancement update

An update for rsyslog is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

USN-4268-1 OpenSMTPD vulnerability

It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root...

OpenSMTPD vulnerable to local privilege escalation and remote code execution

Overview Qualys Research Labs found that the smtpmailaddr function in OpenSMTPD version 6.6 does not properly sanitize user input, which could allow a local attacker to escalate their privileges, and allow either a local or remote attacker to execute arbitrary code as root. Description OpenSMTPD ...

Improper access control

Huawei Share function in P30 9.1.0.193C00E190R2P1 smartphone has an improper access control vulnerability. The function incorrectly controls certain access messages, attackers can simulate a sender to steal P2P network information. Successful exploit may cause information leakage...

Huawei P30 Access Control Error Vulnerability

Huawei P30 is a smartphone from Chinese company Huawei Huawei. An access control error vulnerability exists in the Share feature in Huawei P30 version 9.1.0.193 C00E190R2P1. An attacker can exploit the vulnerability to steal information from a P2P network by emulating a sender...

PT-2019-15927 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.9.2 Description: The issue allows an attacker to crash a push-notification driver with a crafted email when push notifications are used, due to a NULL Pointer Dereference. This can be achieved by using a group...