40 matches found
thunderbird: Leak of hashed Window credentials via crafted attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to...
thunderbird: User Interface (UI) Misrepresentation of attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the...
thunderbird: User Interface (UI) Misrepresentation of attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the...
thunderbird: Leak of hashed Window credentials via crafted attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to...
thunderbird: User Interface (UI) Misrepresentation of attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the...
thunderbird: Leak of hashed Window credentials via crafted attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to...
thunderbird: User Interface (UI) Misrepresentation of attachment URL
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the...
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 128.9.2 bsc1241277 CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL CVE-2025-2830: Information Disclosure of /tmp directory listing CVE-2025-3523: User Interface UI Misrepresentation of...
CVE-2025-3522
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...
SUSE CVE-2025-3522
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...
Mozilla Thunderbird < 137.0.2
The version of Thunderbird installed on the remote Windows host is prior to 137.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-26 advisory. - When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header...
CVE-2025-3522
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...
CVE-2025-3523
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...
CVE-2024-30263
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the file parameter. Users with view rights can access restricted PDF attachments if the...
WordPress Plugin Social Media Share Buttons Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2024-18221 · WordPress · Social Media Share Buttons
Name of the Vulnerable Software and Affected Versions: Social Media Share Buttons plugin for WordPress versions up to, and including, 2.1.0 Description: The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input through the...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-17480)
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS has a cross-site scripting vulnerability that can be exploited to inject web scripts and obtain sensitive information via the attachmenturl parameter of admin/index.php/setting/site?tab=siteattachment...
CVE-2014-0824
Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database CCMDB 7....
Microsoft Wordpad 5.1 - .doc Null Pointer Dereference
Microsoft Wordpad 5.1 - .doc Null Pointer Dereference Microsoft Wordpad 5.1 .doc Null Pointer Dereference Vulnerability Found by condis Tested on Windows XP SP 3 Proffesional PL MS Wordpad 5.1 Compilation 2600.xpsp.080413-2111 SP 3 This isn't bug from CWE 2009-0259 $ Binnary diff of template file...
CVE-2005-4143
SQL injection vulnerability in Lyris ListManager 5.0 through 8.9a allows remote attackers to execute arbitrary SQL commands via SQL code after a numeric argument to a /read/attachment URL...