SOGo Webmail security vulnerability

SOGo Webmail is a SOGo open source webmail and collaboration system. A security vulnerability exists in SOGo Webmail 5.6.0 and earlier versions, which stems from an insecure direct object reference that could lead to an authenticated user impersonating another user to send mail...

Amazon Linux 2023 : jakarta-mail (ALAS2023-2025-1117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1117 advisory. In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. CVE-2025-7962 Tenable has extracted the preceding description...

OESA-2025-1933 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

ExaGrid EX10 security vulnerabilities

ExaGrid EX10 is a backup storage server from ExaGrid USA. A security vulnerability exists in ExaGrid EX10 versions 6.3 through 7.0.1.P08, which stems from improper access control of the MailConfiguration API endpoint and could lead to obtaining SMTP credentials...

UBUNTU-CVE-2025-53008

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver...

CVE-2025-53008

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver...

net.micedre.keycloak:keycloak-mail-whitelisting (1.5), org.keycloak:keycloak-dependencies-server-all (19.0.0) +15 more potentially affected by CVE-2025-7365 via org.keycloak:keycloak-services (19.0.0)

org.keycloak:keycloak-services MAVEN version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - net.micedre.keycloak:keycloak-mail-whitelisting 1.5 - org.keycloak:keycloak-dependencies-server-al...

CVE-2025-53008: Insufficiently Protected Credentials

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver...

[SECURITY] Fedora 42 Update: thunderbird-128.13.0-1.fc42

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 41 Update: thunderbird-128.13.0-1.fc41

Mozilla Thunderbird is a standalone mail and newsgroup client...

MB CONNECT LINE mbNET.mini resource management error vulnerability (CNVD-2025-21146)

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. A resource management error vulnerability exists in MB CONNECT LINE mbNET.mini that originates from exhausting critical...

CVE-2025-7393

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

MyBB Mail Unauthorized Access

The vulnerability of the Mail function in the MyBB forum creation software is related to insufficient testing of requests on the server side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

SUSE CVE-2025-7962

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

ai.mindconnect:mc-mail-imap (0.8.4), app.tozzi:pec-parser (>=5.0.0, <=5.1.2) +2260 more potentially affected by CVE-2025-7962 via org.eclipse.angus:angus-mail (>=2.0.0, <=2.0.3)

org.eclipse.angus:angus-mail MAVEN version =2.0.0, =5.0.0, =1.0.1, =1.0.1-rc14, =1.1.16, =1.0.1-rc14, =1.1.17, =29.v7c3891a434c3, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =8.2.2 and more Source cves: CVE-2025-7962 Source advisory: SNYK:JAVA-ORGECLIPSEANGUS-12239873...

Jakarta Mail vulnerable to SMTP Injection

In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

org.eclipse.angus:angus-mail (1.1.0) potentially affected by CVE-2025-7962 via org.eclipse.angus:smtp (1.1.0)

org.eclipse.angus:smtp MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.angus:smtp and may be impacted: - org.eclipse.angus:angus-mail 1.1.0 Source cves: CVE-2025-7962 Source advisory: OSV:GHSA-9342-92GG-6V29...

org.eclipse.angus:angus-mail (1.0.0-m1) potentially affected by CVE-2025-7962 via org.eclipse.angus:smtp (1.0.0-m1)

org.eclipse.angus:smtp MAVEN version 1.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.angus:smtp and may be impacted: - org.eclipse.angus:angus-mail 1.0.0-m1 Source cves: CVE-2025-7962 Source advisory: OSV:GHSA-9342-92GG-6V29...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the handling of SMTP message input. An attacker can inject arbitrary SMTP commands by supplying specially crafted input containing carriage return and line feed characters. Remediation Upgrade...