The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information

The vulnerability in the mail/compose/ComposeActivity.java function of the AOSP Mail component in the Android operating system is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential informati...

Clair - Vulnerability Static Analysis for Containers

Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the compose function in the AOSP Mail component of the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential information through a specially creat...

CVE-2016-2458

The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and...

CVE-2016-2458

The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and...

CVE-2016-2458

The CVE-2016-2458 issue affects AOSP Mail: the compose functionality in Android 5.0.x (pre-5.0.2), 5.1.x (pre-5.1.1), and 6.x (pre-2016-05-01) does not adequately restrict attachments, enabling information disclosure via a crafted app related to ComposeActivity.java and ComposeActivityEmail.java....

PT-2016-2222

Name of the Vulnerable Software and Affected Versions AOSP Mail versions prior to 4.4.4 AOSP Mail versions 5.0.x prior to 5.0.2 AOSP Mail versions 5.1.x prior to 5.1.1 AOSP Mail versions 6.x before 2016-04-01 Description The issue is related to the lack of protection for sensitive data in the...

Mail.ru: XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо

Здравствуйте! https://light.mail.ru/compose и https://m.mail.ru/composeid/reply подвержены второму вектору XSS похожему на 88492. Вторая уязвимость существует из-за недостаточной фильтрации текста сообщения, на которое хочет ответить пользователь, при его выводе в - поле ответа - в качестве цитат...

Fedora 19 : claws-mail-3.11.1-2.fc19 / claws-mail-plugins-3.11.1-1.fc19 / libetpan-1.6-1.fc19 (2014-14237) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

openSUSE Security Update : claws-mail (openSUSE-SU-2014:1384-1) (POODLE)

Claws Mail was updated to version 3.11.0. Changes : + SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability CVE-2014-3566. + Several PGP/Core plugin improvements : - Indicate when a key has been revoked or has expired when displaying signature status. - Whe...

Fedora 20 : claws-mail-3.11.1-2.fc20 / claws-mail-plugins-3.11.1-1.fc20 / libetpan-1.6-1.fc20 (2014-14234) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

CVE-2012-5565

Cross-site scripting XSS vulnerability in js/compose-dimp.js in Horde Internet Mail Program IMP before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic vi...

CVE-2012-5565: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/compose-dimp.js in Horde Internet Mail Program IMP before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic vi...

PT-2014-2339

Name of the Vulnerable Software and Affected Versions Horde Internet Mail Program IMP versions prior to 5.0.24 Horde Groupware Webmail Edition versions prior to 4.0.9 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafte...

How to use PGP encryption with Mozilla Thunderbird Email client

In my last article, we have learnt that how to encrypt our Emails using Gnu Privacy Guard. Previously we used Microsoft Outlook as a desktop mail client and a GpgOL plugin to handle encryption decryption of our communication. Since Microsoft is a US-based company, that has to follow all the laws ...

CVE-2013-5645

Multiple cross-site scripting XSS vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in 1 new or 2 draft mode, related to compose.inc; and 3 might allow remote authenticated users to injec...

PT-2010-5161

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.2.1 Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with a .phtml extension using the draft save feature in the Compose Mail component, and then accessing thi...

CVE-2010-3909: Improper Control of Generation of Code

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...

Multiple browsers DoS

Mail program compose message window is created for avery frame with mailto:, news:, nntp:, etc URI...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSconfigdirplugins parameter to plugins/address/admin/index.php, 2 GLOBALSconfigdirfunctions parameter to plugins/im/compose.php, and 3...