Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the manipulation of the notification ID in the request URL by a logged-in attacker. This issue due to insufficient authorization checks, enabling attackers to view sensitive mail details belonging to othe...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the manipulation of the notification ID in the request URL by a logged-in attacker. This issue due to insufficient authorization checks, enabling attackers to view sensitive mail details belonging to othe...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the manipulation of the notification ID in the request URL by a logged-in attacker. This issue due to insufficient authorization checks, enabling attackers to view sensitive mail details belonging to othe...

CVE-2024-55186

An IDOR Insecure Direct Object Reference vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...

CVE-2024-55186

A security vulnerability exists in Oqtane Framework version 6.0.0 , an open-source content management system and application framework. The issue is an Insecure Direct Object Reference (IDOR) that occurs when the system fails to properly validate authorization for notification IDs. A logged-in us...

CVE-2024-55196

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers...

CVE-2024-55196

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers...

CVE-2024-55196

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers...

GoPhish security vulnerabilities

GoPhish is an open source phishing framework from GoPhish Open Source. A security vulnerability exists in GoPhish version v0.12.1, which stems from insufficient credential protection in the mail server configuration, which allows an attacker to access configured IMAP and SMTP servers with plainte...

CVE-2024-55196

The GoPhish v0.12.1 application contains a vulnerability where insufficiently protected credentials in the Mail Server Configuration allow an attacker to access cleartext passwords for configured IMAP and SMTP servers . This issue is associated with CWE-312 (Cleartext Storage of Sensitive Informa...

PT-2024-36492 · Gophish +1 · Gophish +1

Name of the Vulnerable Software and Affected Versions: GoPhish version 0.12.1 Description: The issue allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers due to insufficiently protected credentials in the Mail Server Configuration. Recommendations: For GoPhish...

WordPress 10CentMail plugin <= 2.1.50 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin 10CentMail versions = 2.1.50...

Nextcloud: [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed

Vulnerability description not provided...

[SECURITY] Fedora 40 Update: thunderbird-128.5.2-1.fc40

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2024-54273

Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through = 1.0.14...

CVE-2024-54273

CVE-2024-54273: Mail Picker’s Deserialization of Untrusted Data leads to Object Injection in Mail Picker versions up to 1.0.14. CVSS v3.1 base score 9.8 (CRITICAL); impact on confidentiality, integrity, availability HIGH. Root cause is deserialization of untrusted data in the plugin. Remediation:...

CVE-2024-54273 WordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through = 1.0.14...

CVE-2024-54273 WordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker allows Object Injection.This issue affects Mail Picker: from n/a through 1.0.14...

[SECURITY] Fedora 41 Update: thunderbird-128.5.2-1.fc41

Mozilla Thunderbird is a standalone mail and newsgroup client...

WordPress plugin Mail Picker code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...