Android AOSP Mail e-mail information disclosure vulnerability

No description provided by source...

MicroMail Email Client for Android - Gesture Password Insecure Storage Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. Micro Mail Mail Client for Android - There is an insecure storage vulnerability for gesture passwords, when a user uses a gesture password, the password is stored in plaintext and can be...

21CN Email Client - Micro Mail IOS Version XSS Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. XSS vulnerability exists in the IOS version of 21CN Email Client - MicroMail, which allows attackers to insert malicious js code into the page to obtain user cookies and other information,...

Yahoo Bug Bounty #37 - Sender Spoofing Vulnerability

Document Title: =============== Yahoo Bug Bounty 37 - Sender Spoofing Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1985 Video: https://www.youtube.com/watch?v=QYZRbRqs50g Advisory: https://www.vulnerability-lab.com/getcontent.php?id=1777 Release Date:...

Yahoo Bug Bounty #37 - Sender Spoofing Vulnerability

Document Title: =============== Yahoo Bug Bounty 37 - Sender Spoofing Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1985 Video: https://www.youtube.com/watch?v=QYZRbRqs50g Advisory: https://www.vulnerability-lab.com/getcontent.php?id=1777 Release Date:...

JVN#70380788: BASP21 vulnerable to mail header injection

BASP21 provided by B21Soft, Inc. contains a mail header injection vulnerability. Impact The header of an email created by BASP21 to be sent from a web application mail form may be altered by an unauthenticated remote attacker. As a result, an unintended email may be sent or a denial-of-service Do...

Android OSP Mail Arbitrary Attachment Read Vulnerability

Android is an open source operating system based on Linux. A security vulnerability in the email/provider/AttachmentProvider.java file in Android's AOSP Mail allows remote attackers to exploit the vulnerability to build malicious apps that can read the contents of attachments...

Nextcloud: URI scheme bypass in mail app lead to HTML content spoof and opener control

Bug When we load a HTML mail from mailbox via api, etc http://nextcloud/index.php/apps/mail/accounts//folders/SU5CT1g=/messages//html Our content will be passed to HTML Purifier to strip malicious XSS patterns. After that, an filter will apply to transform acceptable URI schemes http, https, ftp,...

OPENSUSE-SU-2016:2485-1 Security update for MozillaThunderbird

This update for Mozilla Thunderbird to version 45.4.0 fixes the following issues: - When using Thunderbird in a browser like context, for rendering HTML e-mail or feeds, it may be affected by vulnerabilities also fixed in Firefox ESR 45.4. MFSA 2016-86, boo999701 The following bugs were fixed in...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

Code injection

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

CVE-2016-3918 affects AOSP Mail’s email/provider/AttachmentProvider.java. The issue arises in Android versions 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, 6.x up to 2016-10-01, and 7.0 up to 2016-10-01, where certain values are not validated as integers, enabling a local attacker to re...

Sophos UTM Frontend Component Local Information Disclosure Vulnerability

Sophos UTM aka Astaro Security Gateway is a suite of unified threat management appliances from Sophos UK. The appliance provides gateway security protection and endpoint security protection. An information disclosure vulnerability exists in the Frontend component of Sophos UTM using firmware...

Vulnerability alert: JPEG 2 0 0 0 a vulnerability to execute arbitrary code-a vulnerability warning-the black bar safety net

Vulnerability number CVE-2 0 1 6-8 3 3 2 TALOS-2 0 1 6-0 1 9 3 Affected version OpenJpeg openjp2 2.1.1 Vulnerability description Recently, Cisco's Talos security team disclosed a JPEG 2 0 0 0 of a zero-day exploit, the vulnerability can execute arbitrary code. OpenJPEG is an open-source JPEG 2 0 ...

CVE-2016-7968

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

Cybozu Office vulnerable to mail header injection

Overview Cybozu Office contains a mail header injection vulnerability in the process of sending emails. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning Partnershi...