CVE-2019-14837

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

Design/Logic Flaw

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'email protected'...

CVE-2019-14837

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

CVE-2019-14837

Keycloak before version 8.0.0 is affected by a logic/identity flaw where the owner of the placeholder.org domain can configure a mail server on that domain and reset a client’s password using only the client name (e.g., [email protected]) to log in. The available public documen...

PT-2019-5233 · Cyrus +4 · Cyrus Imap +4

Name of the Vulnerable Software and Affected Versions: Cyrus IMAP versions prior to 2.5.15 Cyrus IMAP versions 3.0.x prior to 3.0.13 Cyrus IMAP versions 3.1.x through 3.1.8 Description: The issue is related to a lack of input validation mechanism in the Cyrus IMAP server, which can be exploited b...

[SECURITY] Fedora 30 Update: cyrus-imapd-3.0.12-1.fc30

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

[SECURITY] Fedora 31 Update: clamav-0.101.5-1.fc31

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure

A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure...

keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure

A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure...

keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure

A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure...

CVE-2019-14837

A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure. Mitigation It is not a very straight forward workaround but it is possible to mitigate this by manual...

The vulnerability of the string_vformat component in the Exim mail server, which allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the stringvformat component in the Exim mail server is related to buffer overflow vulnerabilities. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36914)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36915)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

IceWarp Mail Server Path Traversal Vulnerability (CNVD-2019-36907)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A path traversal vulnerability exists in IceWarp Webclient versions prior to 10.2.1. Th...

IceWarp Mail Server Path Traversal Vulnerability (CNVD-2019-36908)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A path traversal vulnerability exists in IceWarp Webclient versions prior to 10.2.1. Th...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36911)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36906)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

CVE-2019-17112

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user "Operator" access level to access the configuration file of the mail server except for the password...

CVE-2019-17112

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user "Operator" access level to access the configuration file of the mail server except for the password...