[SECURITY] Fedora 35 Update: thunderbird-91.6.2-1.fc35

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2022-24732 Maddy Mail Server does not implement account expiry

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

CVE-2022-24732 Maddy Mail Server does not implement account expiry

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

CVE-2022-24732 Maddy Mail Server does not implement account expiry

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

CVE-2022-24732

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

CVE-2022-24732

CVE-2022-24732 affects Maddy Mail Server prior to 0.5.4, where PAM authentication does not enforce password expiry or account expiry checks. The root cause is missing expiry validation during PAM auth, enabling continued access for expired accounts unless manually filtered. The public description...

WP HTML Mail < 3.1.3 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/options-general.php?page=wp-html-mail&tab=advanced&a"alert/XSS/...

CVE-2022-24732: Insufficient Session Expiration

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

Maddy Mail Server security vulnerability

Maddy Mail Server is a composable all-in-one mail server from the Russian individual developer Max Mazurov. A security vulnerability exists in maddy Mail Server versions prior to 0.5.4, which stems from not implementing password expiration or account expiration checks when using PAM for...

Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server

Impact Any configuration on any maddy version 0.5.4 using auth.pam is affected. No password expiry or account expiry checking is done when authenticating using PAM. Patches Patch is available as part of the 0.5.4 release. Workarounds If /etc/shadow authentication is used, it is possible to replac...

GHSA-6CP7-G972-W9M9 Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server

Impact Any configuration on any maddy version 0.5.4 using auth.pam is affected. No password expiry or account expiry checking is done when authenticating using PAM. Patches Patch is available as part of the 0.5.4 release. Workarounds If /etc/shadow authentication is used, it is possible to replac...

OESA-2022-1561 mutt security update

Mutt is a small but very powerful text-based mail client for Unix operating systems. Security Fixes: Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g...

CVE-2022-0384 Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapigetwpusers AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog...

PT-2022-16837

Name of the Vulnerable Software and Affected Versions maddy versions prior to 0.5.4 Description The issue concerns the Maddy Mail Server, an open source SMTP compatible email server. It does not implement password expiry or account expiry checking when authenticating using PAM. This affects...

mail-ssl.de Improper Access Control vulnerability OBB-2411790

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mail.zurich.express Improper Access Control vulnerability OBB-2388186

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mail.mieten.events Improper Access Control vulnerability OBB-2388174

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 35 Update: seamonkey-2.53.11-1.fc35

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...

Code injection

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

Ubuntu 20.04 LTS : WebKitGTK vulnerabilities (USN-5306-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5306-1 advisory. A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a...