CVE-2021-32707

CVE-2021-32707 affects Nextcloud Mail prior to version 1.9.6: the privacy filter did not filter images with a background-image CSS attribute, allowing a remote CSS background image to reveal whether an email was read. Images passed through the Nextcloud image proxy, so IP leakage was not reported...

Bypass of image blocking in Nextcloud Mail

None...

PT-2021-19873 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 1.9.6 Description: The Nextcloud Mail application has an issue where the privacy filter fails to filter images with a background-image CSS attribute, potentially leaking the read state. However, images are sti...

PT-2021-21858 · Sylpheed +3 · Sylpheed +3

Name of the Vulnerable Software and Affected Versions: Claws Mail versions prior to 3.18.0 Sylpheed versions prior to 3.7.1 Description: The issue is related to insufficient link checks in the textview uri security check function in textview.c before accepting a click. This could potentially lead...

Nextcloud 安全漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in Nextcloud Mail versions prior to 1.9.6, which stems from a privacy filter failing to filter images with the...

CVE-2021-20779

Cross-site request forgery CSRF vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20779

The CVE-2021-20779 issue affects the WordPress plugin WordPress Email Template Designer - WP HTML Mail, specifically versions prior to 3.0.8. The vulnerability is Cross-site Request Forgery (CSRF) that can allow an attacker to hijack administrator authentication via unspecified vectors. Root caus...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 A cross-site request forger...

WP HTML Mail < 3.0.8 - CSRF to XSS

The plugin did not have any CSRF in place when saving its options, which could allow attacker to make a logged in administrator change them. Due to the lack of sanitisation in some of them, Stored XSS could also be achieved...

WordPress WP HTML Mail plugin <= 3.0.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Konan Nagashima in WordPress WP HTML Mail plugin versions = 3.0.6. Solution Update the WordPress WP HTML Mail plugin to the latest available version at least 3.0.8...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager

✍️ Description Stored XSS in setting up mail sender's name sue to improper sanitization of user input. 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Go to http://192.168.43.130:8081/app/admin/pageSettings.php?search-settings=smtp 2. Enter payload " 3. Now visit...

Advisory ROSA-SA-2021-1966

Software: ruby 2.0.0.648 OS: Cobalt 7.9 CVE-ID: CVE-2012-6684 CVE-Crit: MEDIUM CVE-DESC: A cross-site scripting XSS vulnerability in the RedCloth 4.2.9 library for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI. CVE-STATUS: default CVE-REV:...

Design/Logic Flaw

Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type...

Microsoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks

Microsoft patched two bugs in its Chromium-based Edge browser last week, one of which could be used by an attacker to bypass security and to remotely inject and execute arbitrary code on any website just by sending a message. That security-bypassing bug, CVE-2021-34506, is rated CVSS 5.4, or...

OPENSUSE-SU-2021:0943-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting XSS vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670:...

OPENSUSE-SU-2021:0942-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting XSS vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670:...

Roehling PostSRSd Denial of Service Vulnerability

Roehling Postsrsd is a C-based program by Roehling's personal developer that provides reverse SRS functionality for mail servers. PostSRSd suffers from a denial of service vulnerability that stems from a problem caused by Postfix sending certain long data fields, such as email addresses for...

Dovecot 1.2.0 - 2.3.14 DoS Vulnerability

Dovecot is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

OPENSUSE-SU-2021:0931-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting XSS vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670:...

The vulnerability of the Dovecot mail server arises from incorrect neutralization of special elements in the output data used by the incoming component, allowing attackers to expose user credentials.

The vulnerability of the Dovecot mail server is related to incorrect neutralization of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a remote attacker to expose user credentials...