WhoAmIMailBot - A Service To Mask Your Email

What is it? A service to mask your e-mails, it was inspired by Blur service, where you create a alias for your e-mail, and use it to signup on applications, but the problem on Blur, is that all e-mails pass trough they infraestructure, and I don't need anybody looking on my e-mails, to solve that...

vulners.com: [vulners.com] nginx alias_traversal

Incorrect configuration of alias could allow an attacker to read file stored outside the target folder. https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md Уязвимость только в конфигурации http, на https такого нет. Пример: http GET /static../monit/COPYING HTTP/1.1 Host:...

CVE-2018-6583

SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request...

CVE-2018-6583: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request...

Mail.ru: [mobs.mail.ru] nginx path traversal via misconfigured alias

Domain, site, application -- mobs.mail.ru Steps to reproduce -- http://mobs.mail.ru/media../mobs/settings.py Actual results -- py ... SECRETKEY = '████████████' ... DISTIMOPRIVATEKEY = '████████████' ... PoC, exploit code, screenshots, video, references, additional resources --...

Damon database suffers from a power lifting vulnerability (CNVD-2018-03643)

DM7 is a new-generation database product designed by Damon on the basis of summarizing the R&D and application experience of DM series products, absorbing the advantages of mainstream database products, and adopting JAVA-like virtual machine technology. DM7 database has a privilege loophole, low...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2017-9767

Multiple cross-site scripting XSS vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Name or 2 Description parameter to RM/Reservation/ReserveNew; the 3 Description parameter to RM/Topology/Update; the 4 Name, 5...

Exiv2 Denial of Service Vulnerability (CNVD-2017-27706)

Exiv2 is a suite of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides fast and easy reading and writing of image metadata in a variety of EXIF, IPTC and XMP formats. A denial of service vulnerability exists in the...

Design/Logic Flaw

There is an illegal address access in the extendaliastable function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service...

bind: Processing a response containing CNAME or DNAME with unusual order can crash resolver

A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...

CVE-2017-6086

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...

CVE-2017-6086

CVE-2017-6086 concerns ViMbAdmin 3.0.15. The connected sources describe multiple cross-site request forgery (CSRF) vulnerabilities affecting administrator actions. The root causes are CSRF flaws in the following controller endpoints: DomainController.php (add/delete administrator, change password...

FAQ: XenMobile Derived Credentials

What are Derived Credentials? Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification PIV card or Common Access Card CAC. The derived...

openSUSE Security Update : lynis (openSUSE-2017-705)

This update for lynis fixes the following issues : Lynis 2.5.1 : - Improved detection of SSL certificate files - Minor changes to improve logging and results - Firewall tests: Determine if CSF is in testing mode The Update also includes changes from Lynis 2.5.0 : - CVE-2017-8108: symlink attack m...

CVE-2017-8441

The CVE-2017-8441 issue affects Elastic X-Pack Security: versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This could allow a user with restricted permissions to view data they should not access when performing certain operations against an...

Open Source Solutions ViMbAdmin Cross-Site Scripting Vulnerability

Open Source Solutions ViMbAdmin is an open source Web-based virtual mailbox management system from Open Source Solutions, Ireland. The system supports administrators to manage domains , mail and aliases and so on. A cross-site scripting vulnerability exists in Open Source Solutions ViMbAdmin...

ViMbAdmin 3.0.15 Cross Site Scripting

CVE-2017-5870 Multiple XSS vulnerabilities in ViMbAdmin Product Description ViMbAdmin is a web-based interface used to manage a mail server with virtual domains, mailboxes and aliases. It is an open source solution developed by Opensolutions and distributed under the GNU/GPL license version 3. Th...

CVE-2016-10160

Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...