CVE-2017-6096

CVE-2017-6096 concerns the WordPress Mail Masta 1.0 plugin, with concrete SQL injection flaws reported in multiple vectors. Affects the plugin’s code paths that build SQL using unsanitized input: (1) csvexport.php uses GET parameter list_id without proper filtering, enabling injection via a const...

CVE-2017-6097

CVE-2017-6097 concerns the WordPress plugin Mail Masta 1.0, which contains multiple SQL injection vulnerabilities. The primary entry notes a vulnerable function in /inc/campaign/count_of_send.php that uses a POST parameter camp_id without sufficient validation (authentication to WordPress admin i...

CVE-2017-6095

A SQL injection issue was discovered in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php Unauthenticated with the GET Parameter: listid...

CVE-2017-6098

A SQL injection issue was discovered in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects /inc/campaignsave.php Requires authentication to Wordpress admin with the POST Parameter: listid...

CVE-2017-6095

The WordPress Mail Masta plugin (v1.0) contains multiple SQL injection flaws documented across several feeds. The primary issue is an unauthenticated SQLi in wp-content/plugins/mail-masta/inc/lists/csvexport.php via the list_id GET parameter, where user input is used without proper filtering in S...

CVE-2017-6098

CVE-2017-6098 documents a SQL injection in the WordPress plugin Mail Masta 1.0. The base description states a SQLi in /inc/campaign_save.php via the POST parameter list_id, requiring authentication to the WordPress admin. Connected sources also describe additional SQL injection vectors for the sa...

CVE-2017-6096

A SQL injection issue was discovered in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects /inc/lists/view-list.php Requires authentication to Wordpress admin with the GET Parameter: filterlist...

CVE-2016-4689

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

CVE-2016-7580

An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to cause a denial of service via a crafted URL...

CVE-2016-7580

An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to cause a denial of service via a crafted URL...

CVE-2016-4689

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

CVE-2016-7580

An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to cause a denial of service via a crafted URL...

Code injection

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

CVE-2016-4689

The CVE-2016-4689 entry affects Apple iOS Mail prior to 10.2. Root cause: the S/MIME policy failed to check whether a certificate was revoked, allowing an email signed with a revoked certificate to appear valid. Impact: users could be misled into trusting revoked-signature emails. Mitigation: App...

CVE-2016-4689

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate...

CVE-2016-7580

An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to cause a denial of service via a crafted URL...

Cybozu Garoon fails to restrict access permission in the mail function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the mail function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may alter the order of the mail folders. Solution...

Lithium Forum - (Compose Message) SSRF Vulnerability

Document Title: =============== Lithium Forum - Compose Message SSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2030 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-ID: ==================================== 2030...

Lithium Forum - (Compose Message) SSRF Vulnerability

Document Title: =============== Lithium Forum - Compose Message SSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2030 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-ID: ==================================== 2030...

WordPress Plugin Mail Masta 1.0 - SQL Injection

Exploit Title: Multiple SQL injection vulnerabilities in Mail Masta aka mail-masta plugin 1.0 for Wordpress. Date: 02/18/2017 Exploit Author: Hanley Shun Vendor Homepage: https://wpcore.com/plugin/mail-masta Software Link:...