CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

[SECURITY] Fedora 29 Update: thunderbird-60.6.0-1.fc29

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2019-9868

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator...

[SECURITY] Fedora 29 Update: thunderbird-60.5.3-1.fc29

Mozilla Thunderbird is a standalone mail and newsgroup client...

Mail Carrier 2.5.1 - MAIL FROM Buffer Overflow

Mail Carrier 2.5.1 - MAIL FROM Buffer Overflow Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow Date: March 14, 2019 Exploit Author: Joseph McDonagh Vendor Homepage: N/A Software Link: N/A Version: Mail Carrier 2.5.1 Tested on: Windows Vista Home Basic SP2 CVE: None...

Mail Carrier 2.5.1 Buffer Overflow

Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow Date: March 14, 2019 Exploit Author: Joseph McDonagh Vendor Homepage: N/A Software Link: N/A Version: Mail Carrier 2.5.1 Tested on: Windows Vista Home Basic SP2 CVE: None !/usr/bin/python This script started from PWK, Chapter 6 I a...

Mail Carrier 2.5.1 - 'MAIL FROM' Buffer Overflow

Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow Date: March 14, 2019 Exploit Author: Joseph McDonagh Vendor Homepage: N/A Software Link: N/A Version: Mail Carrier 2.5.1 Tested on: Windows Vista Home Basic SP2 CVE: None !/usr/bin/python This script started from PWK, Chapter 6 I a...

Mail Carrier 2.5.1 - MAIL FROM Buffer Overflow Exploit

Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow Exploit Author: Joseph McDonagh Vendor Homepage: N/A Software Link: N/A Version: Mail Carrier 2.5.1 Tested on: Windows Vista Home Basic SP2 CVE: None !/usr/bin/python This script started from PWK, Chapter 6 I am re-purposing it Tab...

CVE-2019-9557

Ability Mail Server 4.2.6 has Persistent Cross Site Scripting XSS via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...

CVE-2019-9557

Ability Mail Server 4.2.6 has Persistent Cross Site Scripting XSS via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...

Cross site scripting

Ability Mail Server 4.2.6 has Persistent Cross Site Scripting XSS via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...

CVE-2019-9557

CVE-2019-9557 : Ability Mail Server 4.2.6 is affected by a Persistent Cross-Site Scripting (XSS) vulnerability in the email body. An attacker can inject JavaScript within an iframe in the body of an email, requiring the victim to open the message for the exploit to trigger. Public materials (incl...

CVE-2019-9557

Ability Mail Server 4.2.6 has Persistent Cross Site Scripting XSS via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...

Spam and phishing in 2018

Numbers of the year The share of spam in mail traffic was 52.48%, which is 4.15 p.p. less than in 2017. The biggest source of spam this year was China 11.69%. 74.15% of spam emails were less than 2 KB in size. Malicious spam was detected most commonly with the Win32.CVE-2017-11882 verdict. The...

CMS Made Simple < 2.2.10 Multiple Vulnerabilities

CMS Made Simple is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the libcurl library, related to reading beyond the buffer boundaries of memory, allows an attacker to cause a service failure.

The vulnerability of the libcurl library relates to reading data beyond the buffer boundaries for SMTP communication. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

Android Messaging: A Few Bugs Short of a Chain

Posted by Natalie Silvanovich, Project Zero About a year and a half ago, I did some research into Android messaging and mail clients. At the time, I didn’t blog about it, because though I found bugs, I wasn’t able to assemble them into a credible attack. However, in the spirit of writing about...

Ability Mail Server 4.2.6 Cross Site Scripting

Exploit Title: Persistent Cross Site Scripting Ability Mail Server 4.2.6 CVE: CVE-2019-9557 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: https://www.codecrafters.com/AbilityMailServer Category: webapps Attack Type: Remote Impact: Data/Cookie hijackin...

Information disclosure

In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure, sending files accessible to AOSP Mail to a remote email recipient, with no additional execution privileges...

CVE-2019-1995

CVE-2019-1995 affects Android (versions 7.0–9) in the ComposeActivityEmail class. The flaw enables a "confused deputy" scenario where an app could silently attach files to an outgoing email, causing local information disclosure and potentially sending files accessible to AOSP Mail to a remote rec...