Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML mail message could execute JavaScript code in such a way that may result in Thunderbird crashing or executing arbitrary code as the...

Cross-Site Scripting (XSS)

thunderbird is vulnerable to cross-site scripting. Several cross-site scripting XSS flaws were found in the way Thunderbird processed certain malformed HTML mail messages. A malicious HTML mail message could display misleading information which may result in a user unknowingly divulging sensitive...

Exim < 4.93 Privilege Escalation vulnerability

According to its banner, the version of Exim running on the remote host is prior to 4.93. It is, therefore, potentially affected by a privilege escalation vulnerability. A flaw exists in the UNIX symbolic link that could allow an attacker to execute to escalate from the mail user to root. C Tenab...

Vote by Mail Isn't Perfect. But It's Essential in a Pandemic

Despite Donald Trump's invective, the spread of Covid-19 has made the expansion of absentee voting critical...

Microsoft Dynamics CRM 2011 Update Rollup 6

Microsoft Dynamics CRM 2011 Update Rollup 6 INTRODUCTION Update Rollup 6 for Microsoft Dynamics CRM 2011 is available. This article describes the hotfixes and the updates that are included in this update rollup. This update rollup is available for all languages that are supported by Microsoft...

Spam and phishing in 2019

Figures of the year The share of spam in mail traffic was 56.51%, which is 4.03 p.p. more than in 2018. The biggest source of spam this year was China 21.26%. 44% of spam e-mails were less than 2 KB in size. Malicious spam was detected most commonly with the Exploit.MSOffice.CVE-2017-11882 verdic...

Serious Exchange Flaw Still Plagues 350K Servers

Over 80 percent of exposed Exchange servers are still vulnerable to a severe vulnerability – nearly two months after the flaw was patched, and after researchers warned that multiple threat groups were exploiting it. The vulnerability in question CVE-2020-0688 exists in the control panel of...

CVE-2020-8015

A UNIX Symbolic Link Symlink Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1...

CVE-2016-11043

An issue was discovered on Samsung mobile devices with M6.0 software. The S/MIME implementation in EAS uses DES where 3DES is intended. The Samsung ID is SVE-2016-5871 June 2016...

Unspecified vulnerability in CIPPlanner CIPAce (CNVD-2020-21821)

CIPPlanner CIPAce is a suite of business process automation and application development platforms from the US-based CIPPlanner. A security vulnerability exists in CIPPlanner CIPAce version 6.80 Build 2016031401. The vulnerability can be exploited by an attacker to obtain the username and password...

CVE-2020-11599

An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user...

CVE-2019-11049

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations...

AIDA64 Engineer 6.20.5300 - (Report File) filename Buffer Overflow (SEH) Exploit

Exploit Title: AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow SEH Exploit Author: Hodorsec Version: v6.20.5300 Software Link: http://download.aida64.com/aida64engineer620.exe Vendor Homepage: https://www.aida64.com/products/aida64-engineer Tested on: Win7 x86 SP1 - Build 7601...

ArgoSoft Mail Server Detection (HTTP)

Checks whether ArgoSoft Mail Server is present on the target system and if so, tries to figure out the installed version. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of t...

ArgoSoft Mail Server Detection (POP3)

Checks whether ArgoSoft Mail Server is present on the target system and if so, tries to figure out the installed version. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of t...

ArgoSoft Mail Server Detection Consolidation

Consolidation of Argosoft Mail Server detections. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

ArgoSoft Mail Server Detection (SMTP)

Checks whether ArgoSoft Mail Server is present on the target system and if so, tries to figure out the installed version. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)

Exploit Title: AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow SEH Date: 2020-04-02 Exploit Author: Hodorsec Version: v6.20.5300 Software Link: http://download.aida64.com/aida64engineer620.exe Vendor Homepage: https://www.aida64.com/products/aida64-engineer Tested on: Win7 x86...

Spoofing

A UNIX Symbolic Link Symlink Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1...

CVE-2020-8015

CVE-2020-8015 is a local privilege-escalation in Exim packaging affecting openSUSE Factory exim versions prior to 4.93.0.4-3.1. The issue allows escalation from the mail user to root via a UNIX symbolic link (Symlink) following vulnerability. Remediation is to upgrade to Exim 4.93.0.4 or newer; S...