Html Injection

libSOGo.so is vulnerable to HTML injection. The vulnerability is due to improper HTML sanitization within the SOGo Web Mail component, allowing an attacker to preform a phishing attack...

Fedora: Security Advisory for postfix (FEDORA-2024-5c186175f2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-c839e7294f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : python3 (ELSA-2024-0256)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0256 advisory. 3.6.8-56.0.1.3 - Security fix for CVE-2023-27043 Resolves: rhbz2196183 Tenable has extracted the preceding description block directly from the Oracle Linux...

thunderbird security update

CentOS Errata and Security Advisory CESA-2024:0027 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

[SECURITY] Fedora 39 Update: exim-4.97.1-1.fc39

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

PT-2024-4460 · Go +9 · Netmail +9

Name of the Vulnerable Software and Affected Versions: net/mail package in Go affected versions not specified Description: The issue is related to the ParseAddressList function, which incorrectly handles comments within display names. This can lead to different trust decisions being made by...

[SECURITY] Fedora 38 Update: postfix-3.7.9-1.fc38

Postfix is a Mail Transport Agent MTA...

Fedora 38 : exim (2024-e0841c83bb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e0841c83bb advisory. Security fix for CVE-2023-51766. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

The vulnerability in the implementation of the SMTP protocol on email servers allows attackers to circumvent the SPF security policy and send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the SMTP protocol implementation in email servers is related to the lack of checks for the integrity of messages during the processing of the . sequence. Exploiting this vulnerability allows a malicious actor to bypass the SPF security policy and send hidden HTTP requests HTT...

Sendmail < 8.18 SMTP Smuggling Vulnerability (Dec 2023)

Sendmail is prone to a SMTP smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sendmail:sendmail";...

Fedora 39 : python2.7 (2024-06ff0a6def)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-06ff0a6def advisory. Security fix for CVE-2023-27043 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Postfix SMTP Smuggling Vulnerability (Dec 2023)

Postfix is prone to a SMTP smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postfix:postfix"; ifdescripti...

PT-2024-15480 · Soxft · Soxft Timemail

Name of the Vulnerable Software and Affected Versions: soxft TimeMail versions up to 1.1 Description: A critical issue has been found in soxft TimeMail, affecting some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been...

mail.paliwalgroup.com Cross Site Scripting vulnerability OBB-3829513

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>) a different solution is required such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23 3.6.13 3.7.9 3.8.4 or 3.9.

...

[SECURITY] [DLA 3708-1] exim4 security update

Debian LTS Advisory DLA-3708-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 05, 2024 https://wiki.debian.org/LTS Package : exim4 Version : 4.92-8+deb10u9 CVE ID : CVE-2023-51766 Debian Bug : 1059387 It was discovered that Exim, a mail transport agent, c...

[SECURITY] [DSA 5597-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5597-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 04, 2024 https://www.debian.org/security/faq -...

WP Mail Log Plugin < 1.1.3 - Contributor+ Arbitrary File Upload

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'sendemail' function. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code...

GHSA-2X7R-93WW-CXRQ Winter CMS Local File Inclusion through Server Side Template Injection

Impact Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. By default, only th...