CVE-2020-19915

Cross Site Scripting XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php...

curl: CVE-2021-22947: STARTTLS protocol injection via MITM

Summary: A man-in-the-middle can inject cleartext forged responses to future encrypted commands by pipelining them to the STARTTLS response. Steps To Reproduce: Use the attached test case within the curl test system. It is based on IMAP FETCH with explicit TLS. Upon test failure, the downloaded...

KnockOutlook - A Little Tool To Play With Outlook

"The best feeling is to win by knockout." - Nonito Donaire Overview KnockOutlook is a C project that interacts with Outlook's COM object in order to perform a number of operations useful in red team engagements. Command Line Usage metadata of every account search : search for the provided keyword...

New Microsoft Exchange 'ProxyToken' Flaw Lets Attackers Reconfigure Mailboxes

Details have emerged about a now-patched security vulnerability impacting Microsoft Exchange Server that could be weaponized by an unauthenticated attacker to modify server configurations, thus leading to the disclosure of Personally Identifiable Information PII. The issue, tracked as...

Security Bulletin: Apache CXF Vulnerability Affects IBM Global Mailbox (CVE-2021-22696)

Summary Security vulnerability have been Identified In Apache CXF library shipped with IBM Global Mailbox. Vulnerability Details CVEID: CVE-2021-22696 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by improper validation of requesturi parameter by the OAuth 2 authorization...

NCH IVM Attendant Cross-Site Scripting Vulnerability

NCH IVM Attendant is an application of nch. A cross-site scripting vulnerability exists in NCH IVM Attendant, which stems from the product's Mailbox name failing to properly filter incoming data for special characters, and could be exploited by attackers to execute client-side code...

CVE-2021-37448

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name stored...

CVE-2021-37448

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name stored...

CVE-2021-37451

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= reflected...

CVE-2021-37448

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name stored...

NCH IVM Attendant 跨站脚本漏洞

NCH IVM Attendant is an application of nch. A cross-site scripting vulnerability exists in NCH IVM Attendant, which stems from the product's Mailbox name failing to properly filter incoming data for special characters, and could be exploited by attackers to execute client-side code...

Stored XSS Vulnerability in 189 Mailbox of China Telecom Group Corporation Ltd.

189 Mailbox is a new type of work and business mailbox for all Internet users. A stored XSS vulnerability exists in China Telecom Group Corporation's 189 mailbox, which can be exploited by attackers to obtain sensitive information such as user cookies...

CVE-2021-22781

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

Design/Logic Flaw

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

CVE-2021-22781

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

PT-2021-3894

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description The issue is related to an information disclosure vulnerability in Microsoft Exchange Server, associated with weaknesses in the authentication procedure. This vulnerability...

Fedora: Security Advisory for isync (FEDORA-2021-754af4d52b)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Microsoft Disrupts Large, Cloud-Based BEC Campaign

Threat hunters at Microsoft recently uncovered and disrupted infrastructure that powered a large-scale business email compromise BEC campaign. The infrastructure was hosted on multiple cloud platforms, which allowed it to stay under the radar for quite some time. “The attackers performed discrete...

OPENSUSE-SU-2021:0533-1 Security update for isync

This update for isync fixes the following issues: - isync was updated to version 1.3.5 - CVE-2021-20247: reject funny mailbox names from IMAP LIST/LSUB boo1182488 This update was imported from the openSUSE:Leap:15.2:Update update project...