15308 matches found
[SECURITY] Fedora 38 Update: postfix-3.7.9-1.fc38
Postfix is a Mail Transport Agent MTA...
Fedora 38 : exim (2024-e0841c83bb)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e0841c83bb advisory. Security fix for CVE-2023-51766. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...
The vulnerability in the implementation of the SMTP protocol on email servers allows attackers to circumvent the SPF security policy and send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the SMTP protocol implementation in email servers is related to the lack of checks for the integrity of messages during the processing of the . sequence. Exploiting this vulnerability allows a malicious actor to bypass the SPF security policy and send hidden HTTP requests HTT...
Fedora 39 : python2.7 (2024-06ff0a6def)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-06ff0a6def advisory. Security fix for CVE-2023-27043 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
Sendmail < 8.18 SMTP Smuggling Vulnerability (Dec 2023)
Sendmail is prone to a SMTP smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sendmail:sendmail";...
Postfix SMTP Smuggling Vulnerability (Dec 2023)
Postfix is prone to a SMTP smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postfix:postfix"; ifdescripti...
PT-2024-15480 · Soxft · Soxft Timemail
Name of the Vulnerable Software and Affected Versions: soxft TimeMail versions up to 1.1 Description: A critical issue has been found in soxft TimeMail, affecting some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been...
mail.paliwalgroup.com Cross Site Scripting vulnerability OBB-3829513
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>) a different solution is required such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23 3.6.13 3.7.9 3.8.4 or 3.9.
...
[SECURITY] [DLA 3708-1] exim4 security update
Debian LTS Advisory DLA-3708-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 05, 2024 https://wiki.debian.org/LTS Package : exim4 Version : 4.92-8+deb10u9 CVE ID : CVE-2023-51766 Debian Bug : 1059387 It was discovered that Exim, a mail transport agent, c...
[SECURITY] [DSA 5597-1] exim4 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5597-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 04, 2024 https://www.debian.org/security/faq -...
WP Mail Log Plugin < 1.1.3 - Contributor+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'sendemail' function. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code...
GHSA-2X7R-93WW-CXRQ Winter CMS Local File Inclusion through Server Side Template Injection
Impact Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. By default, only th...
WiFi-password-stealer - Simple Windows And Linux Keystroke Injection Tool That Exfiltrates Stored WiFi Data (SSID And Password)
Have you ever watched a film where a hacker would plug-in, seemingly ordinary, USB drive into a victim's computer and steal data from it? - A proper wet dream for some. Disclaimer : All content in this project is intended for security research purpose only. Introduction During the summer of 2022,...
Mozilla: S/MIME signature accepted despite mismatching message date
The Mozilla Foundation Security Advisory: The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despi...
Mozilla: Truncated signed text was shown with a valid OpenPGP signature
The Mozilla Foundation Security Advisory: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header...
PT-2024-41772
Name of the Vulnerable Software and Affected Versions Ceph affected versions not specified Description An issue exists in Ceph related to incorrect certificate checking when using Pybind. This flaw could allow an attacker to perform a Man In the Middle MITM attack, potentially compromising mail...
CVE-2023-51410
Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2...
