Passwords stored in plain text by mailcommander

mailcommander 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisor...

RHEL 8 : cyrus-imapd (RHSA-2020:4655)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4655 advisory. The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd:...

IceWarp Mail Server Detection (SMTP)

SMTP based detection of IceWarp Mail Server. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: cyrus-imapd security update

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd: privilege escalation in HTTP request CVE-2019-18928 cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used,...

Moderate: opensc security, bug fix, and enhancement update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. The following packages have been upgraded to a later upstream...

Security update for claws-mail (moderate)

openSUSE Security Update: Security update for claws-mail Announcement ID: openSUSE-SU-2020:1822-1 Rating: moderate References: 1157594 1177967 Cross-References: CVE-2020-15917 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An...

OPENSUSE-SU-2020:1822-1 Security update for claws-mail

This update for claws-mail fixes the following issues: - Additional cleanup of the template handling claws-mail was updated to 3.17.8 boo1177967 Shielded template's |program and |attachprogram so that the command-line that is executed does not allow sequencing such as with && || ;, preventing...

[SECURITY] Fedora 33 Update: thunderbird-78.4.0-1.fc33

Mozilla Thunderbird is a standalone mail and newsgroup client...

Exploit for OS Command Injection in Oscommerce

PoC exploit for CVE-2020-27976, an authenticated remote code exe...

Huawei EulerOS: Security Advisory for evolution-data-server (EulerOS-SA-2020-2243)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SonarSource SonarQube Information Disclosure Vulnerability (CNVD-2020-64787)

SonarSource SonarQube is an open source code quality management system from SonarSource Switzerland. An information disclosure vulnerability exists in SonarQube version 8.4.2.36762, which can be exploited by an attacker to discover plaintext SMTP, SVN, and GitLab credentials via an api set value...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27974

NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUSSCMBlockStart.php?code= XSS...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

Cross site scripting

NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUSSCMBlockStart.php?code= XSS...

Command injection

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27974

NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUSSCMBlockStart.php?code= XSS...

CVE-2020-27974

CVE-2020-27974 affects NeoPost Mail Accounting Software Pro 5.0.6 and is described as a Cross-Site Scripting (XSS) vulnerability in php/Commun/FUS_SCM_BlockStart.php?code=. The connected sources consistently report an XSS condition without additional exploit details; no specific affected versions...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

PT-2020-16883

Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for OS command injection remotely. It is caused by a vulnerable from POST parameter in the admin/mail.php file, which affects the PHP mail function and the sendmail -...