Keycloak 注入漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an injection vulnerability that stems from the fact that the use of special characters during the email registration process could lead to SMTP injection, sending unsolicited short...

UBUNTU-CVE-2025-50340

An Insecure Direct Object Reference IDOR vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server fails to verify whether the authenticated...

SOGo Webmail 安全漏洞

SOGo Webmail is a SOGo open source webmail and collaboration system. A security vulnerability exists in SOGo Webmail 5.6.0 and earlier versions, which stems from an insecure direct object reference that could lead to an authenticated user impersonating another user to send mail...

Amazon Linux 2023 : jakarta-mail (ALAS2023-2025-1117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1117 advisory. In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. CVE-2025-7962 Tenable has extracted the preceding description...

OESA-2025-1933 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

ExaGrid EX10 安全漏洞

ExaGrid EX10 is a backup storage server from ExaGrid USA. A security vulnerability exists in ExaGrid EX10 versions 6.3 through 7.0.1.P08, which stems from improper access control of the MailConfiguration API endpoint and could lead to obtaining SMTP credentials...

UBUNTU-CVE-2025-53008

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver...

[SECURITY] Fedora 42 Update: thunderbird-128.13.0-1.fc42

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 41 Update: thunderbird-128.13.0-1.fc41

Mozilla Thunderbird is a standalone mail and newsgroup client...

MB CONNECT LINE mbNET.mini resource management error vulnerability (CNVD-2025-21146)

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. A resource management error vulnerability exists in MB CONNECT LINE mbNET.mini that originates from exhausting critical...

CVE-2025-7393

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

The vulnerability of the Mail function in the MyBB forum creation software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Mail function in the MyBB forum creation software is related to insufficient testing of requests on the server side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

SUSE CVE-2025-7962

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

app.tozzi:pec-parser (>=5.0.0 <=5.1.2), at.datenwort.commons:smtp4j (>=1.0.1 <=1.0.8) +2148 more potentially affected by CVE-2025-7962 via org.eclipse.angus:angus-mail (>=2.0.0 <=2.0.3)

org.eclipse.angus:angus-mail MAVEN version =2.0.0, =5.0.0, =1.0.1, =1.0.1, =1.1.16, =1.0.1, =1.1.17, =29.v7c3891a434c3, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =7.6.0, =8.2.2 and more Source cves: CVE-2025-7962 Source advisory: SNYK:JAVA-ORGECLIPSEANGUS-12239873...

app.tozzi.mail:pec-parser (=4.0.0), app.tozzi:uudecoder (=4.0.0) +1257 more potentially affected by CVE-2025-7962 via com.sun.mail:jakarta.mail (>=2.0.0-RC1 <=2.0.1)

com.sun.mail:jakarta.mail MAVEN version =2.0.0-RC1, =0.2.0, =0.2.0, =2.0.1, =2.0.0, =0.1, =0.4, =1.0.0, =2022.3.4.0, =1.0.0-JDK21, =1.0.3.2-JDK21 - cn.sunyblog.easymail:easymail-spring-boot-starter3 =1.0.1 and more Source cves: CVE-2025-7962 Source advisory: SNYK:JAVA-COMSUNMAIL-12028709...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the handling of SMTP message input. An attacker can inject arbitrary SMTP commands by supplying specially crafted input containing carriage return and line feed characters. Remediation Upgrade...

Improper Neutralization

Overview org.eclipse.angus:angus-mail is an Angus Mail Provider. Affected versions of this package are vulnerable to Improper Neutralization via the handling of SMTP message input. An attacker can inject arbitrary SMTP commands by supplying specially crafted input containing carriage return and...

com.blazebit:blaze-notify-channel-smtp (=1.0.0-Alpha6), com.blazebit:blaze-notify-server (=1.0.0-Alpha6) +21 more potentially affected by CVE-2025-7962 via org.eclipse.angus:smtp (>=1.0.0-M1 <=2.0.3)

org.eclipse.angus:smtp MAVEN version =1.0.0-M1, =1.0.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.7 and more Source cves: CVE-2025-7962 Source advisory: OSV:GHSA-9342-92GG-6V29...

app.tozzi.mail:pec-parser (=4.0.0), app.tozzi:uudecoder (=4.0.0) +1243 more potentially affected by CVE-2025-7962 via com.sun.mail:jakarta.mail (>=2.0.0 <=2.0.1)

com.sun.mail:jakarta.mail MAVEN version =2.0.0, =0.2.0, =0.2.0, =2.0.1, =2.0.0, =0.1, =0.4, =1.0.0, =2022.3.4.0, =1.0.0-JDK21, =1.0.3.2-JDK21 - cn.sunyblog.easymail:easymail-spring-boot-starter3 =1.0.1 and more Source cves: CVE-2025-7962 Source advisory: OSV:GHSA-9342-92GG-6V29...