Pegasus Mail Security Bypass Vulnerability

Pegasus Mail a.k.a. Pmail is an e-mail client available for the Microsoft Windows operating system. A security vulnerability exists in the winpm-32.exe file in Pegasus Mail version 4.72 build 572. An attacker can exploit this vulnerability to execute code with the help of a specially crafted...

Nine Mail - Best Biz Email App - BSD license, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Nine Mail - Best Biz Email App published at the 'play' market has multiple vulnerabilities...

18-Byte ImageMagick Hack Could Have Leaked Images From Yahoo Mail Server

After the discovery of a critical vulnerability that could have allowed hackers to view private Yahoo Mail images, Yahoo retired the image-processing library ImageMagick. ImageMagick is an open-source image processing library that lets users resize, scale, crop, watermarking and tweak images. The...

CVE-2017-9046

winpm-32.exe in Pegasus Mail aka Pmail v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers th...

CVE-2017-9046

winpm-32.exe in Pegasus Mail aka Pmail v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers th...

Code injection

winpm-32.exe in Pegasus Mail aka Pmail v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers th...

CVE-2017-9046

CVE-2017-9046 affects Pegasus Mail (winpm-32.exe) v4.72 build 572. A DLL load flaw in ssgp.dll on the desktop enables remote via a crafted DLL to execute code when a user clicks a mailto: link from a remote page. Exploitation relies on locally installed ssgp.dll; DllMain is the execution point. M...

CVE-2017-9046

winpm-32.exe in Pegasus Mail aka Pmail v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers th...

Pegasus 4.72 Build 572 Remote Code Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PEGASUS-MAILTO-LINK-REMOTE-CODE-EXECUTION.txt + ISR: APPARITIONSEC Vendor: ============= www.pmail.com Product: ===================== Pegasus "winpm-32.exe" v4.72 build 572...

Pegasus winpm-32.exe v4.72 Mailto: Link Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PEGASUS-MAILTO-LINK-REMOTE-CODE-EXECUTION.txt + ISR: APPARITIONSEC Vendor: ============= www.pmail.com Product:...

WordPress PHPMailer Host Header Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in WordPress version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer, a mail-sending library that is bundled with WordPress. A valid WordPress username is required to exploit the vulnerability. Additionally, due to t...

Secure Mail gives Error: Your organization does not allow this action

- User opens Secure Mail. - Goes into Contacts. - Selects a contact. - Clicks on the contacts phone number. - Sees error message:Your organization does not allow this action...

How to use Safari instead of Secure Web to open the links from Secure Mail?

In order to achieve the desired behavior, change the Allowed URL filed in MDX policies of Secure Mail Refer to Citrix documentation - Allow Secure Web domains MDX policy for Secure Mail...

CVE-2016-4879

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2016-4886

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2016-4886

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2016-4877

Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4879

Cross-site request forgery CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...