CVE-2013-6674

Cross-site scripting XSS vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a...

CVE-2013-6674

Cross-site scripting XSS vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a...

Design/Logic Flaw

Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability."...

Live HTTP Support (RHINO) 4.1 Cross Site Scripting

Advisory: Live http support RHINO 4.1 Frontend - XSS & Remote Change Password Author: Slotleet Email: [email protected] Affected Software: Successfully tested on Live http support RHINO 4.1 Vendor URL: http://www.livesupportrhino.com Vendor Status: Not Fixed ==========================...

LinkedIn shutting down its security-plagued INTRO app in Early March

Last October, the social network 'LinkedIn' launched a controversial Smartphone app called 'Intro' that intercepts and route all of your emails through LinkedIn servers to inject LinkedIn profiles of the sender directly into the mails. The app was released for Android, as well as iOS devices. Why...

CVE-2014-1643

The Web Email Protection component in Symantec Encryption Management Server aka PGP Universal Server before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL...

CVE-2014-1643

Symantec Encryption Management Server (aka PGP Universal Server) Web Email Protection prior to 3.3.2 is vulnerable: an authenticated Web Messenger/Remote user can alter a URL to view another user’s stored outbound emails due to a flaw in Web Email Protection’s access restrictions. Affected versio...

CVE-2014-1643

The Web Email Protection component in Symantec Encryption Management Server aka PGP Universal Server before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL...

CVE-2013-7177

config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

CVE-2013-7176

config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

CVE-2013-7177

config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

CVE-2013-7177

config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression...

CVE-2014-0647

The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file /Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog, which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads...

SmarterMail Email正文HTML注入漏洞

Bugtraq ID:64970 SmarterMail是一款邮件服务程序。 SmarterMail不正确过滤Email正文数据，允许远程攻击者利用漏洞构建恶意邮件，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 SmarterMail 11.x 目前没有详细解决方案提供： http://www.smartertools.com/smartermail/mail-server-software.aspx ?php / Exploit Title: SmarterMail Enterprise and Standard =11.x Stored XSS Google...

AfterLogic Pro / Lite 7.1.1.1 Cross Site Scripting

Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/AfterLogic/Default.aspx Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer...

SmarterMail Enterprise and Standard 11.x - Persistent Cross-Site Scripting

Click Me, Please...\r\n NOTE: javascript html char encode = then you will be able to get into the victim's mailbox via the url: http://WebSite/Smarter/Default.aspx I used phpmailer class for beside of the exploit so you need to download it here and run the exploit in the phpmailer di...

SmarterMail 11.x Cross Site Scripting

Click Me, Please...\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://WebSite/Smarter/Default.aspx I used phpmailer class for beside of the exploit so you need to download it here and run the exploit in the phpmailer...

HackerOne: CSRF login

1 Attacker creates a fake account and changes e-mail 2 The e-mail confirmation link can now be used to CSRF login someone into the fake account, then monitor actions performed by the victim or even interact with him...

CVE-2013-4065

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...

Cross site scripting

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPRs PTHN9AQMV7 and TCLE98ZKRP...