Crlf injection

CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall EMF 6.x allow remote attackers to 1 trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and 2 cause an "increased number of missed spam" during "spam outbreaks."...

CVE-2006-0487

Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall EMF 6.x allow remote attackers to 1 trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and 2 cause an "increased number of missed spam" during "spam outbreaks."...

UebiMiau Webmail System Security Vulnerability

I.Vulnerability UebiMiau Webmail System Cross Site Scripting Vulnerability II.Vendor Aldoir Ventura III.Affected Systems UebiMiau 2.7.9 latest release and probably previous versions. IV.About UebiMiau is a simple, yet efficient mail reader webmail supporting both IMAP and POP3 without dependence ...

CVE-2006-0321

fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service crash via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster...

CVE-2006-0321

fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service crash via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster...

CVE-2005-4661

The CVE-2005-4661 entry affects Campsite prior to version 2.3.3. The notifyendsubs cron job sends an e-mail that contains an unencrypted MySQL password, which can be captured by remote attackers and leads to partial confidentiality loss. The public documents do not provide explicit remediation st...

Mandrake Linux Security Advisory : spamassassin (MDKSA-2005:221)

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients 'To' addresses, which triggers a bus error in Perl. Updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

Cross site scripting

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

CVE-2006-0091

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

CVE-2006-0091

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

CVE-2006-0075

Direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field mail variable in a new message, which is written to a PHP file...

CVE-2005-1753

ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to sourc...

CVE-2005-4661

The notifyendsubs cron job in Campsite before 2.3.3 sends an e-mail message containing a certain unencrypted MySQL password, which allows remote attackers to sniff the password...

CVE-2005-4775

Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash...

CVE-2005-4413

Multiple cross-site scripting XSS vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the 1 E-mail address field to a PlantsByWebSphere/login.jsp, 2 message field to b TechnologySample/BulletinBoard Script, 3...

CVE-2005-4324

Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service service stop via an e-mail message with an "invalid format."...

CVE-2005-4300

Format string vulnerability in the lirepop function in pop.c in libremail 1.1.0 and earlier, with compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response...

CVE-2005-4209

WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message, which prevents the user from being able to access the Inbox folder, possibly due to a cross-site scripting XSS...