20 matches found
CVE-2026-84465
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...
CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...
CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...
CVE-2026-84465
The open source helpdesk system Zammad is vulnerable to sender impersonation in versions prior to 7.1.2 . The root cause is that the system fails to verify if an S/MIME-signed email's certificate is genuinely trusted; instead, it only checks if a certificate with a matching name exists in the sys...
EUVD-2026-43026
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...
CVE-2026-56223 Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a...
Dokploy 信任管理问题漏洞
Dokploy is an open-source software developed by Dokploy itself. Versions of Dokploy from 0.27.0 to 0.29.3 had a security vulnerability related to trust management. This vulnerability stemmed from a hardcoded BETTERAUTHSECRET fallback value, which allowed unauthorized attackers to forge email-base...
CVE-2026-29142: Missing Cryptographic Step
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email...
EUVD-2000-0385
Malware in sbrugna...
Mattermost: ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNT
A vulnerability was found in a website that allowed an attacker to trick a victim into using a crafted email address for a particular session, leading to the attacker taking back the victim's account and accessing their private messages. The vulnerability was triggered by removing the email value...
Matrix Synapse 跨站脚本漏洞
Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability was previously present in Matrix Synapse version 1.27.0, which allowed an attacker to exploit the vulnerability to insert forged content into an email message...
CVE-2020-5767
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-35448)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, 3.7.5 and 3.6.7. An attacker can exploit the vulnerability to add a forged link to an email notification...
HiFriend - 'cgi-bin/hifriend.pl' Open Email Relay
source: https://www.securityfocus.com/bid/30320/info HiFriend is prone to an open-email-relay vulnerability. An attacker could exploit this issue by constructing a script that would send unsolicited bulk email to an unrestricted amount of email addresses with a forged email address. !/usr/bin/per...
Webbler CMS 3.1.3 - Mail A Friend Open Email Relay
source: https://www.securityfocus.com/bid/25045/info The 'webbler' is prone to an open-email-relay vulnerability. An attacker may leverage the issue to use webservers that are hosting the vulnerable software to send arbitrary unsolicited bulk email. Attackers may also forge email messages that...
CVE-2000-1203
Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service CPU consumption by forging an email message with the sender as [email protected] localhost, which causes Domino to enter a mail loop...
CVE-2000-0386
The CVE-2000-0386 entry concerns FileMaker Pro 5 Web Companion, where remote attackers can send anonymous or forged email. The provided documents confirm this description but do not include deeper root-cause, affected versions, exploit details, or remediation. No explicit fix/version information ...
CVE-2000-0386
FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email...