RHEL 9 : thunderbird (RHSA-2024:10667)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10667 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: Potential disclosure of plaintext in OpenPGP...

CVE-2024-53772

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through = 1.0.15...

CVE-2024-53772

CVE-2024-53772 refers to a DOM-based XSS in the Mail Picker plugin for WordPress. Affected software: PickPlugins Mail Picker, versions up to and including 1.0.14 (WordPress Mail Picker). The vulnerability arises from Improper Neutralization of Input During Web Page Generation, enabling cross-site...

CVE-2024-53772 WordPress Mail Picker plugin <= 1.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Mail Picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through 1.0.14...

CVE-2024-53772 WordPress Mail Picker plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through = 1.0.15...

WordPress plugin Mail Picker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-35884 · Pickplugins · Pickplugins Mail Picker

Name of the Vulnerable Software and Affected Versions: PickPlugins Mail Picker versions 1.0.14 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacker...

[SECURITY] Fedora 41 Update: thunderbird-128.5.0-1.fc41

Mozilla Thunderbird is a standalone mail and newsgroup client...

PT-2024-17385 · Surgemail · Surgemail

Name of the Vulnerable Software and Affected Versions: SurgeMail version v78c2 Description: A Cross-Site Scripting XSS issue could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters. Recommendations: For SurgeMail version v78c2,...

WordPress Mail Picker plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Mail Picker versions = 1.0.15...

BEC-ware the Phish (part 3): Detect and Prevent Incidents in M365

TL;DR Take lessons learned from investigation, such as reviewing how emails evaded existing phishing controls to update anti-malware policies. Configure Defender for Office and Defender for Cloud Apps threat and alert policies to prevent and detect email-based attacks. Don’t rely on out-of-the-bo...

Advisory ROSA-SA-2024-2528

Software: libspf2 1.2.11 OS: rosa-server79 packageevrstring: libspf2-1.2.11-11.20210922git4915c308.res7 CVE-ID: CVE-2021-20314 BDU-ID: 2021-04420 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SPF protocol library libspf2 is related to an operation exceeding buffer boundaries in memory...

U.S. Dept Of Defense: Exposed Extremely Sensitive Information in Public ZIP File

A publicly accessible ZIP file containing sensitive information, including SMTP credentials, database connection details, and AWS secret keys, was discovered. The sensitive data was exposed due to the lack of proper access controls and encryption. The exposed credentials could have been misused f...

CVE-2024-48533

A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts...

CVE-2024-45510

CVE-2024-45510 is a stored XSS in Zimbra Collaboration (ZCS) up to version 10.0, affecting Zimbra Webmail (Modern UI). The vulnerability arises from improper sanitization of user input, allowing an attacker-supplied payload in email fields to be stored and executed when the contact list is viewed...

CVE-2024-45510

An issue was discovered in Zimbra Collaboration ZCS through 10.0. Zimbra Webmail Modern UI is vulnerable to a stored Cross-Site Scripting XSS attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the...

CVE-2024-52509

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients...

CVE-2024-52508

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like [email protected] that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would ...

CVE-2024-52509 Nextcloud Mail app does not respect download permissions in shares

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients...

CVE-2024-52509 Nextcloud Mail app does not respect download permissions in shares

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients...