Code injection

PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code...

Design/Logic Flaw

PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=alert1 and stealing cookies...

CVE-2021-36719

CVE-2021-36719 refers to PineApp - Mail Secure. The root cause is a vulnerability in the vulnerable nicUpload.php file that allows an authenticated user to upload a malicious file, leading to remote code execution and server takeover. Affected product: PineApp - Mail Secure (user-authenticated co...

CVE-2021-36719 Cybonet - PineApp

PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code...

CVE-2021-36720

PineApp - Mail Secure contains a cross-site scripting (XSS) vulnerability in the /blocking.php?url= parameter that allows injection of arbitrary script code (e.g., ). This can lead to cookie theft and related session information exposure as described in multiple sources. The vulnerability is tied...

CVE-2021-36720 Cybonet - PineApp

PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=alert1 and stealing cookies...

CVE-2021-36719: Unrestricted Upload of File with Dangerous Type

PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code...

CVE-2021-36720: Improper Neutralization of Input During Web Page Generation

PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url= and stealing cookies...

PT-2021-21324

Name of the Vulnerable Software and Affected Versions PineApp Mail Secure affected versions not specified Description The issue allows an attacker to send a request to the "/blocking.php" API endpoint with a malicious URL parameter, potentially leading to cookie theft. The attacker can exploit th...

PT-2021-21323

Name of the Vulnerable Software and Affected Versions PineApp Mail Secure affected versions not specified Description The issue allows an attacker to upload a malicious file by exploiting the vulnerable nicUpload.php file, which can lead to taking over the server and running remote code. The...

Cybonet PineApp Mail Secure Cross-Site Script Vulnerability

Cybonet PineApp Mail Secure from Cybonet Israel blocks most malicious email threats at the network perimeter while providing a range of additional options for comprehensive security and message control. Cybonet PineApp Mail Secure suffers from a cross-site scripting vulnerability that originates ...

Cybonet PineApp Mail Secure code issue vulnerability

Cybonet PineApp Mail Secure from Israel's Cybonet blocks most malicious email threats at the network perimeter while providing a range of additional options for comprehensive security and message control. Cybonet PineApp Mail Secure suffers from a code issue vulnerability that stems from an...

Cloudflare Public Bug Bounty: Hijack all emails sent to any domain that uses Cloudflare Email Forwarding

The Email Routing feature enables Cloudflare users to create any number of custom email addresses and route all incoming messages to the user's preferred inboxes. Due to a bug in zone ownership verification, it was possible to configure Email Routing to redirect e-mail messages for an unverified...

UBUNTU-CVE-2021-43527

NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be impacted. Applications using N...

CVE-2021-43360

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services...

CVE-2021-43360

Sunnet eHRD is a talent management system from Sun Chat Technology. The CVE-2021-43360 vulnerability affects its e-mail delivery task schedule’s serialization function, where inadequate input object validation and restriction allows a post-authenticated remote attacker with database access privil...

CVE-2021-43360: Deserialization of Untrusted Data

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services...

PT-2021-23821

Name of the Vulnerable Software and Affected Versions Sunnet eHRD affected versions not specified Description The issue concerns inadequate input object validation and restriction in the serialization function of Sunnet eHRD's e-mail delivery task schedule. This allows a post-authenticated remote...

Mail Client DoS

The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Mail Client DoS

The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...