CVE-2012-2592

CVE-2012-2592 affects Axigen Mail Server 8.0.1 and is a Cross-site Scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the body of an email. Connected sources confirm the affected product and vulnerability class, but do not provide a patch version or remedi...

CVE-2012-2592

Cross-site scripting XSS vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email...

Coremail 邮件系统存储型 XSS

简要描述： 设计疏忽导致可执行恶意 JavaScript 代码。 详细说明： 我原以为和 WooYun: Coremail邮件系统存储型XSS之二 这里是同一种文件漏洞，问过之后，了解到不是同一个。 本漏洞是直接预览 SVG 图片附件，会触发 SVG 内部脚本。新版本 Coremail “除了部分格式的图片和PDF”，不知道有没有修复这个问题，姑且发出来吧。 如图，用户预览附件即会触发 XSS。 （不嫌麻烦的话可以配合之前获取 sid/mid 的漏洞，在正文内插入链接、跳转到附件 SVG 的预览地址，作为伪装。） 漏洞证明：...

Secunia.com CSI/VIM - Persistent Validation Vulnerabilities

Document Title: =============== Secunia.com CSI/VIM - Persistent Validation Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1272 Article:...

Secunia.com CSI/VIM - Persistent Validation Vulnerabilities

Document Title: =============== Secunia.com CSI/VIM - Persistent Validation Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1272 Article:...

Debian Security Advisory DSA 2960-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service. OpenVAS Vulnerability Test $Id: deb2960.nasl 6724 2017-07-14...

Phabricator: Abusing daemon logs for Privilege escalation under certain scenarios

Setup Needed + A normal user account + A momentary disruption of mail services Replication steps + Login as normal user + Wait for momentary disruption of mail services + Use Password Reset Link for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of...

[SECURITY] Fedora 20 Update: sendmail-8.14.8-2.fc20

The Sendmail program is a very widely used Mail Transport Agent MTA. MTAs send mail from one machine to another. Sendmail is not a client program, which you use to read your email. Sendmail is a behind-the-scenes program which actually moves your email over networks or the Internet to where you...

openSUSE Security Update : dovecot12 (openSUSE-SU-2011:0540-1)

dovecot crash when parsing mail headers that contain NUL characters CVE-2011-1929 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dovecot12-4609. The text description of this plugin is C SUSE...

openSUSE Security Update : dovecot20 (dovecot20-4610)

dovecot crash when parsing mail headers that contain NUL characters CVE-2011-1929 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dovecot20-4610. The text description of this plugin is C SUSE...

openSUSE Security Update : claws-mail (openSUSE-SU-2012:1374-1)

A denial of service attack NULL ptr dereference in claws mail was fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-719. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : dovecot12 (dovecot12-4609)

dovecot crash when parsing mail headers that contain NUL characters CVE-2011-1929 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dovecot12-4609. The text description of this plugin is C SUSE...

openSUSE Security Update : mailman (openSUSE-SU-2012:0660-1)

local users could read mailman's mail archive %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-298. The text description of this plugin is C SUSE LLC...

CVE-2014-1533

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

DEBIAN-CVE-2009-5023

The 1 dshield.conf, 2 mail-buffered.conf, 3 mynetwatchman.conf, and 4 mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt...

Anymacro Mail System 6 /share.php SQL注入漏洞

No description provided by source...

Domain restricted signup is creating enabled users on ApacheDS

When a user signs up to a Confluence instance that has domain restricted sign up enabled, they are normally created as disabled users and are unable to login. However, when the underlying user directory does not support disabling users, such as ApacheDS 1.5, then the user ends up being created as...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

Code injection

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...