ROS-20240730-09

Vulnerability of NTLM New Technology LAN Manager protocol implementation in Exim mail server is related to operation exceeding buffer boundaries in memory when processing requests. Exploitation of the vulnerability could allow a remote intruder to gain unauthorized access to protected information...

SMTP 安全漏洞

SMTP is a complete e-mail delivery suite for SMTP. A security vulnerability exists in SMTP that stems from the fact that the hosting service does not validate the sender of an e-mail message against an authenticated user, allowing an attacker to spoof another user's e-mail address...

ROS-20240712-01

Vulnerability in Multiline RFC 2231 component of Exim mail server is related to incorrect analysis of the the multiline RFC 2231 header file name. Exploitation of the vulnerability could allow an attacker, acting remotely, to deliver executable attachments to end-user mailboxes...

Critical Exim Mail Server Vulnerability Exposes Millions to Malicious Attachments

A critical security issue has been disclosed in the Exim mail transfer agent that could enable threat actors to deliver malicious attachments to target users' inboxes. The vulnerability, tracked as CVE-2024-39929, has a CVSS score of 9.1 out of 10.0. It has been addressed in version 4.98. "Exim...

Fedora: Security Advisory (FEDORA-2024-f3e0255c75)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-34539

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...

CVE-2024-34539

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...

PT-2024-13754 · Unknown · Vx Search Enterprise

Name of the Vulnerable Software and Affected Versions: VX Search Enterprise version 10.2.14 Description: A vulnerability has been discovered that could allow an attacker to execute persistent XSS through the "/setup smtp" API endpoint in the smtp server, smtp user, smtp password, and smtp email...

Hp LaserJet Pro Printer 安全漏洞

The HP Hp LaserJet Pro Printer is a laser printer from Hewlett-Packard HP in the United States. A security vulnerability exists in the Hp LaserJet Pro Printer that originates from a user with device administrative privileges being able to change the existing SMTP server settings on the device...

PT-2024-4026

Name of the Vulnerable Software and Affected Versions: HP Color LaserJet MFP M478-M479 series affected versions not specified Description: The issue is related to a weakness in the authentication procedure of the HP Color LaserJet MFP M478-M479 series, which can potentially expose protected SMTP...

CVE-2024-35187

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-35187 Stalwart Mail Server has privilege escalation by design

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-35187 Stalwart Mail Server has privilege escalation by design

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-35187

CVE-2024-35187 affects Stalwart Mail Server prior to version 0.8.0. Attacks achieving Arbitrary Code Execution as the stalwart-mail user (including web interface admins) can obtain complete root privileges, effectively breaking the intended service isolation. The issue is mitigated by upgrading t...

CVE-2024-35187 Stalwart Mail Server has privilege escalation by design

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

Stalwart Mail Server 安全漏洞

Stalwart Mail Server is an all-in-one mail server from Stalwart Labs. A security vulnerability exists in Stalwart Mail Server versions prior to 0.8.0 that originates from a vulnerability that allows an attacker to gain full root access to the system...

PT-2024-26367 · Unknown · Stalwart Mail Server

Name of the Vulnerable Software and Affected Versions: Stalwart Mail Server versions prior to 0.8.0 Description: The issue affects Stalwart Mail Server, an open-source mail server, where attackers who achieved Arbitrary Code Execution as the stalwart-mail user, including web interface admins, can...

CVE-2024-35179

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using RUNASUSER, the specified user and therefore, web interface admins can read arbitrary files as root. This issue affects admins who have set up to run stalwart with RUNASUSER who handed out admin credentials to t...

CVE-2024-35179 Unprivileged Stalwart Mail Server user can read files as root

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using RUNASUSER, the specified user and therefore, web interface admins can read arbitrary files as root. This issue affects admins who have set up to run stalwart with RUNASUSER who handed out admin credentials to t...

CVE-2024-35179

CVE-2024-35179 affects Stalwart Mail Server prior to 0.8.0, where using RUN_AS_USER allows the specified user (including web-admins) to read arbitrary files as root. The underlying issue is tied to RUN_AS_USER usage, enabling privilege escalation to root-level file access. A patch is available in...