Directory traversal

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

Directory traversal

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

Code injection

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

Dovecot Read Across Boundaries Vulnerability Vulnerability

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . An out-of-bounds read vulnerability exists in Dovecot version 2.2.33.2. An attacker can exploit this vulnerability to cause a denial of service and obtain sensitive information by sending specially crafted emai...

CVE-2018-7707

Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...

CVE-2018-7701

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2018-7707

Affected software : SecurEnvoy SecurMail prior to 9.2.501. Vulnerability : Cross-site scripting (XSS) via an HTML-formatted e-mail message. Root cause / vector : not explicitly detailed beyond the XSS in HTML-format emails; multiple sources attribute vulnerability to improper handling of HTML ema...

CVE-2018-7704

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7705

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

SpiderFoot 2.12 - Automates OSINT to find out everything possible about your target

SpiderFoot is a reconnaissance tool that automatically queries over 100 public data sources OSINT to gather intelligence on IP addresses, domain names, e-mail addresses, names and more. You simply specify the target you want to investigate, pick which modules to enable and then SpiderFoot will...

[SECURITY] Fedora 26 Update: clamav-0.99.4-1.fc26

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

Open-Xchange: Stored-XSS with user interaction on [sandbox.open-xchange.com] via inserted link in mail

Hello, I would like to report about Stored-XSS on sandbox.open-xchange.com via inserted link in mail. Steps to Reproduce ---- 1 Login as first user User A and start creating new mail message 2 Click on a insert link button and paste the following text qwe"-alertdocument.domain-" into Url and Plea...

SecureMail: Unable to send emails "You cannot send the mail"

Only one user couldn't send mails, it failed with error message "You cannot send the mail" unable to send mails or reply to mails with or without attachment. The user is able to receive emails successfully...

Updated dovecot packages fix security vulnerabilities

Dovecot has been updated to version 2.2.34 to fix two security issues. CVE-2017-14461: This vulnerability comes in two flavors. A malicious party can send a specially crafted email to a vulnerable system, causing it to crash dovecot. In some systems, the mail can be stored into the mail system,...

"Incorrect username or password" on Secure Mail after Exchange Server upgrade to 2016 CU8

Since the exchange server was upgraded from Exchange 2016 to Exchange server 2016 CU8, users are facing 2 issues as below. 1. Existing users are unable to sync e-mail. 2. New users are unable to logon...

[SECURITY] Fedora 27 Update: clamav-0.99.4-1.fc27

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 27 Update: sharutils-4.15.2-8.fc27

The sharutils package contains the GNU shar utilities, a set of tools for encoding and decoding packages of files in binary or text format in a special plain text format called shell archives shar. This format can be sent through e-mail which can be problematic for regular binary files. T he shar...

CVE-2017-17138

PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10...

DEBIAN-CVE-2017-14461

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the...

CVE-2018-7634

An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to...