CVE-2016-1212

CVE-2016-1212 affects Futomi MP Form Mail CGI Professional Edition up to version 3.2.3, exposing a directory traversal vulnerability (CWE-22). The flaw allows remote authenticated administrators to read arbitrary files on the server via unspecified vectors. Public records from NVD/JVN describe th...

CVE-2016-1212

Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

Mapbox (API) - Filter Bypass & Persistent Vulnerability

Document Title: =============== Mapbox API - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1787 ID: 119802 Release Date: ============= 2016-06-05 Vulnerability Laboratory ID VL-ID:...

XenMobile POC Cheat Sheet

The purpose of this cheat sheet is to provide a detailed POC checklist to assist with the implementation of On-Premise POC implementations. This checklist includes a detailed diagram of your XenMobile POC implementation populated from the information included in the filled out checklist. Addition...

Cybozu Garoon fails to restrict access permissions

Overview Cybozu Garoon is a groupware. Cybozu Garoon fails to restrict access permissions in the mail function. Note that this vulnerability is different from JVN33879831. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc...

Cybozu Garoon vulnerable to information disclosure

Overview Cybozu Garoon is a groupware. Cybozu Garoon contains an information disclosure vulnerability in the mail function. Masato Kinugawa reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC...

Cybozu Garoon mail function vulnerable to access restriction bypass

Overview Cybozu Garoon is a groupware. Cybozu Garoon contains an access restriction bypass vulnerability in the mail function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A spoofed e-mail may be sent by a user. Solution Update the...

JVN#18975349: Multiple access restriction bypass vulnerabilities in Cybozu Garoon

Cybozu Garoon is a groupware. Cybozu Garoon contains multiple access restriction bypass vulnerabilities below. Operation restriction bypass in the mail function - CVE-2016-1188 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2|...

JVN#25765762: Cybozu Garoon vulnerable to information disclosure

Cybozu Garoon is a groupware. Cybozu Garoon contains an information disclosure vulnerability in the mail function. Impact By sending a specially crafted email, an attacker may be convinced that the user read the email. Solution Update the Software Update to the latest version according to the...

JVN#53542912: Cybozu Garoon fails to restrict access permissions

Cybozu Garoon is a groupware. Cybozu Garoon fails to restrict access permissions in the mail function. Impact An unintentional image file may be displayed on the mail view. As a result, an attacker may be convinced that the user read the email. Solution Update the Software Update to the latest...

shop.royalmail.com XSS vulnerability

Vulnerable URL: http://shop.royalmail.com/issue-by-issue/star-wars/icat/starwars?sort=sequencestarwars=starwars=asc==prestigestampbooklimitede=icat,7,cat110%22onmouseover%3dalert%28/OPENBUGBOUNTY/%29%20rest%3d%22,con,cat111,stampslandingpage,cat158,starwars Details: Description| Value ---|---...

[SECURITY] [DLA 489-1] ruby-mail security update

Package : ruby-mail Version : 2.4.4-2+deb7u1 CVE ID : N/A Debian Bug : N/A This security update fixes a security issue in ruby-mail. We recommend you upgrade your ruby-mail package. Takeshi Terada Mitsui Bussan Secure Directions, Inc. released a whitepaper entitled "SMTP Injection via recipient...

[SECURITY] Fedora 24 Update: thunderbird-45.1.0-2.fc24

Mozilla Thunderbird is a standalone mail and newsgroup client...

TOR Mail Encrypted Server: OnionMail

TOR Mail Encrypted Server for Hidden Services OnionMail is an anonymous, encrypted mail server made to run on TOR network without losing the ability to communicate with the Internet. All OnionMail servers are configured as TOR hidden services and use SSL via STARTTLS. To use OnionMail all you nee...

Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability

Document Title: =============== Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1852 Release Date: ============= 2016-05-25 Vulnerability Laboratory ID VL-ID: ==================================== 18...

DLA-489-1 ruby-mail - security update

Bulletin has no description...

Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability

Document Title: =============== Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1852 Release Date: ============= 2016-05-24 Vulnerability Laboratory ID VL-ID: ==================================== 18...

Futomi MP Form Mail CGI Professional Edition Directory Traversal Vulnerability

Futomi MP Form Mail CGI Professional Edition is a suite of software that sends mail in the form of CGI to a specified E-mail from Futomi, Japan. A directory traversal vulnerability exists in Futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier versions. An attacker can exploit this...

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...