SMTP Smuggling

aiosmtpd is vulnerable to inbound SMTP smuggling. The vulnerability is due to interpretation differences of the SMTP protocol, enabling attackers to send spoofed emails with fake sender addresses, facilitating advanced phishing attacks...

PYSEC-2024-221

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

DEBIAN-CVE-2024-27305

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

UBUNTU-CVE-2024-27305

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

CVE-2024-27305

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

CVE-2024-27305 SMTP smuggling in aiosmtpd

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

BIT-JENKINS-2020-2099

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonati...

BIT-APACHE-2022-22720 HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...

CVE-2024-22313

IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 278749...

CVE-2024-22313

Affected product: IBM Storage Defender - Resiliency Service (2.0). Root cause: hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Impact (as stated): information disclosure with local access risk (confidentiality impact). Remediation: IBM’...

PT-2024-19336 · Ibm · Ibm Storage Defender - Resiliency Service

Name of the Vulnerable Software and Affected Versions: IBM Storage Defender - Resiliency Service version 2.0 Description: The issue concerns hard-coded credentials, such as a password or cryptographic key, used by IBM Storage Defender - Resiliency Service for inbound authentication, outbound...

Slackware: Security Advisory (SSA:2024-022-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] postfix

New postfix packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/postfix-3.6.14-i586-1slack15.0.txz: Upgraded. Security inbound SMTP smuggling: with "smtpdforbidbarenewline = normalize" default "no...

CVE-2023-50948 IBM Storage Fusion HCI information disclosure

IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671...

IBM Storage Fusion Security Vulnerability

IBM Storage Fusion is a fully integrated platform from International Business Machines IBM for running and maintaining all native Red Hat OpenShift applications. A security vulnerability exists in IBM Storage Fusion HCI versions 2.1.0 through 2.6.1, which stems from the system containing hard-cod...

Explained: SMTP smuggling

SMTP smuggling is a technique that allows an attacker to send an email from pretty much any address they like. The intended goal is email spoofing—sending emails with false sender addresses. Email spoofing allows criminals to make malicious emails more believable. Let’s take a closer look at what...

The vulnerability of the Inbound/Outbound Transfer function in the Nagios XI monitoring tool allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Inbound/Outbound Transfer function in Nagios XI relates to the unencrypted storage of critical information in the xioptions database table. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2023-9163 · Ibm · Ibm Storage Fusion Hci

Name of the Vulnerable Software and Affected Versions: IBM Storage Fusion HCI versions 2.1.0 through 2.6.1 Description: The issue concerns the use of hard-coded credentials, such as a password or cryptographic key, which the software uses for its own inbound authentication, outbound communication...

Chinese Hackers Launch Covert Espionage Attacks on 24 Cambodian Organizations

Cybersecurity researchers have discovered what they say is malicious cyber activity orchestrated by two prominent Chinese nation-state hacking groups targeting 24 Cambodian government organizations. "This activity is believed to be part of a long-term espionage campaign," Palo Alto Networks Unit ...

HashiCorp Vault Security Breach

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. A security vulnerability exists in HashiCorp Vault , Vault Enterprise versions 1.15.2, 1.14.6, and 1.13.10, which stems from a client-side inbound request that triggers a policy check that may result in unlimited...