new packages: jakarta-mail

An update is available for jakarta-mail. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-3FM8-7GPF-P8FM SocialNetwork Cross-Site Scripting (XSS) vulnerability

A Cross-Site Scripting XSS was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data mail passed to the 'SocialNetwork-andrea/app/template/pwforgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the...

GHSA-P7VM-PHXX-G722 Improper Input Validation in Apache Commons Email

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

Swift Mailer mail transport Command Injection

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

GHSA-PR44-4JFR-286M Swift Mailer mail transport Command Injection

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

Zeta Components Mail Arbitrary code execution via a crafted email address

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one...

GHSA-HGR8-G756-VMG9 Zeta Components Mail Arbitrary code execution via a crafted email address

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one...

CVE-2013-10001: Improper Certificate Validation

A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used...

PT-2022-7724

Name of the Vulnerable Software and Affected Versions HTC One/Sense version 4.x Description A problem was found in the certification validation of the mail client. An exploit has been disclosed to the public and may be used. Recommendations For HTC One/Sense version 4.x, at the moment, there is n...

[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 34 Update: clamav-0.103.6-1.fc34

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 36 Update: clamav-0.103.6-1.fc36

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

jenkins:repository (>=1.2, <=1.3), org.jenkins-ci.main:jenkins-test-harness (>=1.545, <=1.562) +2 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (2.1)

org.jenkins-ci.main:maven-plugin MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - jenkins:repository =1.2, =1.545, =1.545, =1.10, =1.13 Source cves: CVE-2017-1000397 Source...

org.jenkins-ci.plugins:mail-watcher-plugin (>=1.15, <=1.16), org.jenkins-ci.plugins:sauce-ondemand (>=1.148, <=1.193) potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (2.11)

org.jenkins-ci.main:maven-plugin MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.plugins:mail-watcher-plugin =1.15, =1.148, =1.193 Source cves: CVE-2017-1000397...

org.jenkins-ci.plugins:cisco-spark (>=1.1.0, <=1.1.1), org.jenkins-ci.plugins:email-ext-recipients-column (1.0) +2 more potentially affected by CVE-2018-1000176 via org.jenkins-ci.plugins:email-ext (>=2.25, <=2.43)

org.jenkins-ci.plugins:email-ext MAVEN version =2.25, =1.1.0, =1.1, =0.1-beta, =1.1 Source cves: CVE-2018-1000176 Source advisory: OSV:GHSA-GWXM-WQPQ-W539...

org.jenkins-ci.plugins:cisco-spark (>=1.1.0, <=1.1.1), org.jenkins-ci.plugins:email-ext-recipients-column (1.0) +2 more potentially affected by CVE-2018-1000176 via org.jenkins-ci.plugins:email-ext (>=2.25, <=2.43)

org.jenkins-ci.plugins:email-ext MAVEN version =2.25, =1.1.0, =1.1, =0.1-beta, =1.1 Source cves: CVE-2018-1000176 Source advisory: GHSA-GWXM-WQPQ-W539...

GHSA-W935-P7MG-XC96 Sensitive Data Exposure in baserCMS

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors...

Sensitive Data Exposure in baserCMS

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors...

zend-mail remote code execution via Sendmail adapter

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double...

GHSA-R9MW-GWX9-V3H5 zend-mail remote code execution via Sendmail adapter

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double...