CVE-2021-33490

OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature...

CVE-2021-33490

OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature...

CVE-2021-33490: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature...

CVE-2021-38375: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...

CVE-2021-33491: Improper Limitation of a Pathname to a Restricted Directory

OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records...

PT-2021-20152

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for cross-site scripting XSS attacks via a crafted snippet in a shared mail signature. This can potentially lead to malicious scripts being executed on users' browsers,...

CVE-2021-38377: Use of Insufficiently Random Values

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...

PT-2021-22091

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for XSS via JavaScript code in an anchor HTML comment within truncated e-mail. This is possible because there is a predictable UUID with HTML transformation results...

PT-2021-24041 · Isync +2 · Isync +2

Name of the Vulnerable Software and Affected Versions: isync versions 1.4.0 through 1.4.3 Description: A flaw was found in mbsync due to an unchecked condition, allowing a malicious or compromised IMAP server to use a crafted mail message that lacks headers to provoke a heap overflow, which could...

CVE-2021-42363 Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting

The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the searchorder parameter found in the /views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8...

Gallagher Command Centre Server Trust Management Vulnerability

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings.Gallagher Command Centre Server has a security vulnerability that stems from incorrect certificate validation in the SMTP client, which could be exploited by an...

Book Sale: Click Here to Kill Everybody and Data and Goliath

For a limited time, I am selling signed copies of Click Here to Kill Everybody and Data and Goliath, both in paperback, for just $6 each plus shipping. I have 500 copies of each book available. When theyre gone, the sale is over and the price will revert to normal. Order here and here. Please be...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-101659)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details are provided at this time...

Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing

By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox 94,...

Vulnerability fixed in Cisco Email Security Appliance (ESA)

A vulnerability has been fixed in Cisco Email Security Appliance. The vulnerability allows an unauthenticated remote malicious person to remotely capable of causing a denial-of-service. In order to vulnerability, a malicious party must send a rogue e-mail to the appliance. Due to insufficient inp...

CVE-2021-38502

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message...

Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability

Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message...

CVE-2021-43270

Datalust Seq.App.EmailPlus aka seq-app-htmlemail 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended...

curl: Server responses received before STARTTLS processed after TLS handshake

A flaw was found in curl. The flaw lies in how curl handles cached or pipelined responses that it receives from either a IMAP, POP3, SMTP or FTP server before the TLS upgrade using STARTTLS. In such a scenario curl even after upgrading to TLS would trust these cached responses treating them as...