CVE-2019-4296

IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759...

CVE-2019-12970

CVE-2019-12970 is a disclosed XSS in SquirrelMail prior to updates addressing versions up to 1.4.22 and 1.5.x through 1.5.2. Root cause: improper handling of RCDATA/RAWTEXT in the sanitization mechanism allows bypass, enabling malicious script injection from HTML e-mails when assets such as NOEMB...

Siemens SIPLUS NET CP343-1 ADVANCED Communications Adapter Detection

Binary data 750270.prm...

Siemens SIPLUS NET CP443-1 ADVANCED Communications Adapter Detection

Binary data 750306.prm...

Over Dozen Popular Email Clients Found Vulnerable to Signature Spoofing Attacks

A team of security researchers has discovered several vulnerabilities in various implementations of OpenPGP and S/MIME email signature verification that could allow attackers to spoof signatures on over a dozen of popular email clients. The affected email clients include Thunderbird, Microsoft...

Joomla! Component JiFile 2.3.1 - Arbitrary File Download

Exploit Title: Joomla! Component JiFile 2.3.1 - Arbitrary File Download Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: April 28, 2019 Vendor Homepage: http://www.isapp.it Software Link :...

CVE-2019-11340

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowedlocal3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on...

CVE-2019-11332

MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456...

Default credentials

MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456...

CVE-2019-11332

MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456...

CVE-2019-11332

The CVE-2019-11332 entry concerns MKCMS 5.0. Affected component: the repass.php flow in ucenter. The issue allows remote attackers to takeover arbitrary user accounts by posting a username and e-mail address, which triggers an e‑mail containing the user’s password (demo: 123456). The Red Hat and ...

Open-Xchange: Another Stored XSS in mail app using Drive app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...

Open-Xchange: Stored XSS in mail app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...

openSUSE Security Update : enigmail (openSUSE-2019-477)

This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures : - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs boo1097525 - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode boo1096745...

CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

Advance Gift Shop Pro Script 2.0.3 - SQL Injection

Advance Gift Shop Pro Script 2.0.3 - SQL Injection Exploit Title: Advance Gift Shop Pro Script 2.0.3 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 21, 2019 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link :...

GitLab: Persistent XSS via e-mail when creating merge requests

Summary: The vulnerability consists in the ability to create branch names that contain characters such as /. This branch name is sent via e-mail which is rendered as HTML. Description: One way to exploit this is by forking a repository. Then an attacker would create a branch called alert1 and mak...

NordVPN 6.19.6 - Denial of Service (PoC)

NordVPN 6.19.6 - Denial of Service PoC -- coding: utf-8 -- Exploit Title: NordVPN 6.19.6 - Denial of Service PoC Date: 07/02/2019 Author: Alejandra Sánchez Vendor Homepage: https://nordvpn.com/ Software Link: https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe Version:...

NordVPN 6.19.6 - Denial of Service (PoC)

-- coding: utf-8 -- Exploit Title: NordVPN 6.19.6 - Denial of Service PoC Date: 07/02/2019 Author: Alejandra Sánchez Vendor Homepage: https://nordvpn.com/ Software Link: https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe Version: 6.19.6 Tested on: Windows 10 Proof of...