Multiple vulnerabilities in extension "Direct Mail" (direct_mail)

Denial of Service CVE-2020-12697 The extension provides a functionality to log clicks on links in sent newsletters. This functionality does not limit the amount of log entries generated per link, so it is possible to use a valid link to fill the log table with a huge amount of records...

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

Design/Logic Flaw

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

CVE-2020-12784

CVE-2020-12784 affects cPanel prior to 86.0.14. The issue allows remote attackers to trigger a bandwidth suspension by abusing specific mail log strings (SEC-505). Public references (NVD/Red Hat/CVE listings) corroborate a network-trajectory issue with low attack complexity and no authentication ...

Critical: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

[SECURITY] Fedora 31 Update: seamonkey-2.53.2-1.fc31

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

The vulnerability of many elements of the Cyrus IMAP email server, related to the lack of mechanisms for checking input data, allows attackers to compromise the integrity of information.

The vulnerability of many elements of the Cyrus IMAP email server lies in the lack of mechanisms for checking entered data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of information...

Mozilla Thunderbird < 68.8.0

The version of Thunderbird installed on the remote Windows host is prior to 68.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-18 advisory. - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas Schouten, An...

BMC Control-M/Agent Buffer Overflow Vulnerability

Control-M is one of BMC's most important automation control products, and is the world's leading integrated business scheduling solution for cross-platform and cross-application job scheduling. A buffer overflow vulnerability exists in BMC Control-M/Agent when the On-Do action destination is Mail...

CVE-2020-11737

A cross-site scripting XSS vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring including the quotes followed...

CVE-2020-11737

A cross-site scripting XSS vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring including the quotes followed...

evolution security and bug fix update

evolution 3.28.5-12 - Add patch for RH bug 1778799 New Mail account wizard ignores email address change 3.28.5-11 - Update patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar 3.28.5-10 - Add patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar - Add patch for RH bug...

CVE-2020-1961

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution RCE was discovered...

Server-Side Template Injection

syncope-core-provisioning-java is vulnerable to server-side template injection. Remote attackers are able to inject arbitrary JEXL expressions via the Mail templates and execute arbitrary code on the system...

Open-Xchange: reading the stack data of the imap process

in dovecot / core in the imap-client-hibernate.c file in the imaphibernatehandshake function, lines 31..39 contain vulnerable code: cpp else if ret = readfd, buf, sizeofbuf-1 0 && bufret-1 == '\n' bufret-1 = '\0'; if versionstringverifybuf, "imap-hibernate", 1 return 0; ierror"%s sent invalid...

CVE-2019-19215

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server...

The Weird Partisan Math of Vote-by-Mail

Research says that expanding mail-in voting doesn’t help Democrats. So why are Republicans so afraid of it?...

U.S. Dept Of Defense: No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service

Summary: No-Rate Limit on Password reset endpoint results mail-spam functionality to be abused. Additionally, the password-reset link remain the same after each request. Description: Malicious user could Spear-target █████████ user mail and Spam it for as many requests as he would like. Possible...