15603 matches found
Design/Logic Flaw
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature...
CVE-2021-33491
OX App Suite (Open-Xchange) up to version 7.10.5 is affected by a Directory Traversal vulnerability triggered by ../ in OOXML/ODF ZIP archives, stemming from mishandling of relative paths in mail addresses with auto-configuration DNS records. The issue allows traversal in archives and could enabl...
Exploit for Server-Side Request Forgery in Microsoft
python sendwebshellmail.py https://mail16.echod.com aaa@echo...
CVE-2021-33490
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature...
PT-2021-24041 · Isync +2 · Isync +2
Name of the Vulnerable Software and Affected Versions: isync versions 1.4.0 through 1.4.3 Description: A flaw was found in mbsync due to an unchecked condition, allowing a malicious or compromised IMAP server to use a crafted mail message that lacks headers to provoke a heap overflow, which could...
CVE-2021-42363 Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the searchorder parameter found in the /views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8...
Gallagher Command Centre Server信任管理问题漏洞
Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings.Gallagher Command Centre Server has a security vulnerability that stems from incorrect certificate validation in the SMTP client, which could be exploited by an...
Book Sale: Click Here to Kill Everybody and Data and Goliath
For a limited time, I am selling signed copies of Click Here to Kill Everybody and Data and Goliath, both in paperback, for just $6 each plus shipping. I have 500 copies of each book available. When theyre gone, the sale is over and the price will revert to normal. Order here and here. Please be...
Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-101659)
Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details are provided at this time...
Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox 94,...
Vulnerability fixed in Cisco Email Security Appliance (ESA)
A vulnerability has been fixed in Cisco Email Security Appliance. The vulnerability allows an unauthenticated remote malicious person to remotely capable of causing a denial-of-service. In order to vulnerability, a malicious party must send a rogue e-mail to the appliance. Due to insufficient inp...
CVE-2021-38502
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message...
Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message...
CVE-2021-43270
Datalust Seq.App.EmailPlus aka seq-app-htmlemail 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended...
curl: Server responses received before STARTTLS processed after TLS handshake
A flaw was found in curl. The flaw lies in how curl handles cached or pipelined responses that it receives from either a IMAP, POP3, SMTP or FTP server before the TLS upgrade using STARTTLS. In such a scenario curl even after upgrading to TLS would trust these cached responses treating them as...
The vulnerability of the SysController and MailHandlerController components of the Redmine project and task management web application, related to the disclosure of information due to incompatibility, allows a hacker to gain access to confidential data.
The vulnerability of the SysController and MailHandlerController components in the Redmine project and task management web application is related to changes in the time required for string comparison operations. Exploiting this vulnerability could allow a malicious actor to gain access to...
[SECURITY] Fedora 33 Update: thunderbird-91.2.0-1.fc33
Mozilla Thunderbird is a standalone mail and newsgroup client...
Fedora: Security Advisory for thunderbird (FEDORA-2021-eaa161ca7a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...