SUSE: Security Advisory (SUSE-SU-2019:0414-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2014:0471-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting

Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Date: 2021/08/06 Exploit Author: Mert Daş Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.7 Tested on: Windows 10 Stored Cross-site scriptingXSS:...

SAP Netweaver command injection vulnerability

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A command injection vulnerability exists in SAP NetWeaver AS ABAP, which can be exploited by an attacker to inse...

Update of nginx-mod-http-image-filter, nginx-mod-http-geoip, nginx-mod-http-perl, nginx, nginx-filesystem, nginx-mod-stream, nginx-mod-http-xslt-filter, nginx-mod-mail, nginx-all-modules

...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

celery-smartbase (>=0.3.1, <=0.3.3), doccano (>=1.6.0, <=1.8.0) +5 more potentially affected by CVE-2020-17495 via django-celery-results (>=2.2.0, <=2.3.1)

django-celery-results PYPI version =2.2.0, =0.3.1, =1.6.0, =3.3.3, =1.3.4.7, =1.0.3, =3.6.0, =3.7.3 - vmcenter 1.2.0rc3 Source cves: CVE-2020-17495 Source advisory: OSV:GHSA-FVX8-V524-8579...

celery-smartbase (>=0.3.1, <=0.3.3), doccano (>=1.6.0, <=1.8.0) +5 more potentially affected by CVE-2020-17495 via django-celery-results (>=2.2.0, <=2.3.1)

django-celery-results PYPI version =2.2.0, =0.3.1, =1.6.0, =3.3.3, =1.3.4.7, =1.0.3, =3.6.0, =3.7.3 - vmcenter 1.2.0rc3 Source cves: CVE-2020-17495 Source advisory: GHSA-FVX8-V524-8579...

Email spoofing: how attackers impersonate legitimate senders

Introduction In a nutshell, email spoofing is the creation of fake emails that seem legitimate. This article analyzes the spoofing of email addresses through changing the From header, which provides information about the senders name and address. SMTP Simple Mail Transfer Protocol, the main email...

Meeting links in Secure Mail iOS are not opening in correct applications

Any meeting link opened through Secure Mail does not open the application and gets stuck at Secure Web...

CVE-2021-31855

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server e.g., an IMAP server causes KMail to upload the decrypted content of the message to the remote server. With a crafted message...

Nextcloud: Bypass of privacy filter / tracking pixel blocker

Description ------------ When the mail app receives inline images, it will block them for privacy reasons to prevent tracking pixels The images have been blocked to protect your privacy. This block works correctly for most remote resources in addition to images, remote CSS files, iframes, and som...

Exim Privilege Escalation

The vulnerability of the Exim message transfer agent is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges within the system...

Exim smtp_ungetc() Integer Overflow Code Execution

The vulnerability of the smtpungetc function in the Exim message delivery agent is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted request to the server...

Exim DoS

The vulnerability of the Exim message transfer agent is related to resource management errors. Exploiting this vulnerability allows a malicious actor to perform a Denial-of-Service attack by sending specially crafted data to the application...

Exim extractoption Heap Buffer Overflow RCE

The vulnerability of the extractoption function in the Exim message forwarding agent is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted message to the mail server...

Exim Symbolic Link Privilege Escalation

The vulnerability of the Exim message forwarding agent is related to the tracking of symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges within the system by creating a specially crafted symbolic link to a file and rewriting it with a malicious version...

Exim Privilege Escalation

The vulnerability of the Exim message transfer agent is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow attackers to gain elevated privileges...

CVE-2021-32652

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the...

CVE-2021-32652

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the...