CVE-2021-43461

CVE-2021-43461 affects Rumble Mail Server 0.51.3135 and is a Cross-Site Scripting (XSS) flaw exploitable via the servername parameter. The CVE is documented in multiple feeds (NVD/NIST, Red Hat, CNVD, CVE List) with two metrics: CVSSv2 base score 3.5 (LOW) and CVSSv3.1 base score 5.4 (MEDIUM). No...

CVE-2021-43461

Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter...

CVE-2021-43456

An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path...

CVE-2021-43456

An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path...

CVE-2021-43456

An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path...

Path traversal

An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path...

CVE-2021-43459

A Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the 1 domain and 2 path parameters...

CVE-2021-43459

Rumble Mail Server 0.51.3135 is vulnerable to Cross Site Scripting via the domain and path parameters. The root cause is missing data validation on user-supplied domain/path data, allowing injected JavaScript to execute in the client. Impact is client-side code execution with potential session or...

CVE-2021-43456

An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path...

CVE-2021-43456

CVE-2021-43456 affects Rumble Mail Server 0.51.3135, where an unquoted service path in the RumbleService executable path creates a local privilege escalation vector. The vulnerability allows a local attacker to abuse the service image path and execute arbitrary code on the affected host. CVSS met...

WordPress Mycred plugin <= 2.4.4 - User E-mail Addresses Disclosure vulnerability

User E-mail Addresses Disclosure vulnerability discovered by Krzysztof Zając in WordPress Mycred plugin versions = 2.4.4. Solution Update the WordPress Mycred plugin to the latest available version at least 2.4.4.1...

CVE-2021-43462: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter...

CVE-2021-43459: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the 1 domain and 2 path parameters...

PT-2022-11848

Name of the Vulnerable Software and Affected Versions Rumble Mail Server version 0.51.3135 Description A Cross Site Scripting XSS issue exists, allowing exploitation via the servername parameter. Recommendations For Rumble Mail Server version 0.51.3135, avoid using the servername parameter until ...

PT-2022-11843 · Unknown · Rumble Mail Server

Name of the Vulnerable Software and Affected Versions: Rumble Mail Server version 0.51.3135 Description: An Unquoted Service Path issue exists via a specially crafted file in the RumbleService executable service path. Recommendations: For Rumble Mail Server version 0.51.3135, consider updating to...

Rumble Mail Server Cross-Site Script Vulnerability

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A cross-site scripting vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from the username parameter's lack of data validation filtering for user The...

Rumble Mail Server code-related vulnerabilities

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A code execution vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from an unquoted service path in The service path is not referenced in RumbleService,...

CVE-2021-43461: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter...

PT-2022-11849 · Unknown · Rumble Mail Server

Name of the Vulnerable Software and Affected Versions: Rumble Mail Server version 0.51.3135 Description: A Cross Site Scripting XSS issue exists via the username parameter. Recommendations: For Rumble Mail Server version 0.51.3135, consider restricting access to the login functionality until a...

PT-2022-11846

Name of the Vulnerable Software and Affected Versions Rumble Mail Server version 0.51.3135 Description A Cross Site Scripting XSS issue exists via the domain and path parameters. Recommendations For Rumble Mail Server version 0.51.3135, consider restricting access to the vulnerable parameters...