Privilege Escalation

mutt is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent...

Cross-site Scripting (XSS)

squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. A flaw was found in the way Thunderbird processed text/enhanced and text/richtext formatted mail message. A specially crafted mail message could execute arbitrary code with the privileges of the user running Thunderbird...

Cross-Site Scripting (XSS)

thunderbird is vulnerable to cross-site scripting. Several cross-site scripting XSS flaws were found in the way Thunderbird processed certain malformed HTML mail messages. A malicious HTML mail message could display misleading information which may result in a user unknowingly divulging sensitive...

Cross-Site Scripting (XSS)

thunderbird is vulnerable to cross-site scripting. Several cross-site scripting XSS flaws were found in the way Thunderbird processed certain malformed HTML mail messages. A malicious HTML mail message could display misleading information which may result in a user unknowingly divulging sensitive...

Same-Origin Policy Bypass

thunderbird is vulnerable to same-origin policy bypass. A flaw was found in the way Thunderbird handled the "location.hostname" value during certain browser domain checks. This flaw could allow a malicious HTML mail message to set domain cookies for an arbitrary site, or possibly perform an XSS...

Clickjacking

thunderbird is vulnerable to clickjacking. A flaw was found in the way Thunderbird displayed certain web content. A malicious HTML mail message could generate content which could overlay user interface elements such as the hostname and security indicators, tricking a user into thinking they are...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML mail message could execute JavaScript code in such a way that may result in Thunderbird crashing or executing arbitrary code as the...

Cross-Site Scripting (XSS)

thunderbird is vulnerable to cross-site scripting. Several cross-site scripting XSS flaws were found in the way Thunderbird processed certain malformed HTML mail messages. A malicious HTML mail message could display misleading information which may result in a user unknowingly divulging sensitive...

Exim < 4.93 Privilege Escalation vulnerability

According to its banner, the version of Exim running on the remote host is prior to 4.93. It is, therefore, potentially affected by a privilege escalation vulnerability. A flaw exists in the UNIX symbolic link that could allow an attacker to execute to escalate from the mail user to root. C Tenab...

Vote by Mail Isn't Perfect. But It's Essential in a Pandemic

Despite Donald Trump's invective, the spread of Covid-19 has made the expansion of absentee voting critical...

Microsoft Dynamics CRM 2011 Update Rollup 6

Microsoft Dynamics CRM 2011 Update Rollup 6 INTRODUCTION Update Rollup 6 for Microsoft Dynamics CRM 2011 is available. This article describes the hotfixes and the updates that are included in this update rollup. This update rollup is available for all languages that are supported by Microsoft...

Spam and phishing in 2019

Figures of the year The share of spam in mail traffic was 56.51%, which is 4.03 p.p. more than in 2018. The biggest source of spam this year was China 21.26%. 44% of spam e-mails were less than 2 KB in size. Malicious spam was detected most commonly with the Exploit.MSOffice.CVE-2017-11882 verdic...

Serious Exchange Flaw Still Plagues 350K Servers

Over 80 percent of exposed Exchange servers are still vulnerable to a severe vulnerability – nearly two months after the flaw was patched, and after researchers warned that multiple threat groups were exploiting it. The vulnerability in question CVE-2020-0688 exists in the control panel of...

CVE-2020-8015

A UNIX Symbolic Link Symlink Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1...

CVE-2016-11043

An issue was discovered on Samsung mobile devices with M6.0 software. The S/MIME implementation in EAS uses DES where 3DES is intended. The Samsung ID is SVE-2016-5871 June 2016...

Unspecified vulnerability in CIPPlanner CIPAce (CNVD-2020-21821)

CIPPlanner CIPAce is a suite of business process automation and application development platforms from the US-based CIPPlanner. A security vulnerability exists in CIPPlanner CIPAce version 6.80 Build 2016031401. The vulnerability can be exploited by an attacker to obtain the username and password...

CVE-2020-11599

An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user...

CVE-2019-11049

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations...

AIDA64 Engineer 6.20.5300 - (Report File) filename Buffer Overflow (SEH) Exploit

Exploit Title: AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow SEH Exploit Author: Hodorsec Version: v6.20.5300 Software Link: http://download.aida64.com/aida64engineer620.exe Vendor Homepage: https://www.aida64.com/products/aida64-engineer Tested on: Win7 x86 SP1 - Build 7601...