Resource Timing API Unauthorized Access

The vulnerability of the Resource Timing API interface in browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to improper neutralization of alternative syntax in XSS attacks. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthoriz...

CVE-2021-23933

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

CVE-2021-23933

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

Design/Logic Flaw

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

CVE-2021-23933

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

CVE-2021-23933

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

CVE-2021-23933: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...

PT-2021-15619

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.5 Description: The issue allows for XSS via JavaScript in a Note referenced by a mail:// URL. Recommendations: For OX App Suite versions prior to 7.10.5, update to version 7.10.5 or later to resolve the iss...

Open-xchange OX App Suite Cross-Site Script Vulnerability

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via...

Fedora: Security Advisory for awstats (FEDORA-2020-d1aa0e030c)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Citrix Secure Mail For Android Access Control Error Vulnerability

Citrix Secure Mail For Android is an email client software from Citrix. An access control error vulnerability exists in Citrix Secure Mail for Android in versions prior to 20.11.0. The vulnerability is related to the affected version allowing unauthenticated users to read calendar-related data...

FreeBSD : mail/dovecot -- multiple vulnerabilities (bd98066d-4ea4-11eb-b412-e86a64caca56)

Aki Tuomi reports : When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Mail delivery / parsing crashed when t...

Updated squirrelmail packages fix security vulnerabilities

XSS was discovered in SquirrelMail through 1.4.22. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of for example a NOEMBED,...

[SECURITY] Fedora 33 Update: awstats-7.8-2.fc33

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy server...

Mail.ru: [Biz] [Mailer] Кроп любых* изображений расположенных на сервере

Crop any images at site mailer.i.bizml.ru...

CVE-2020-8275

Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute...

CVE-2020-8275

Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute...

CVE-2020-8274

Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code 'Code Injection' by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to...

CVE-2020-8274

Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code 'Code Injection' by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to...