Security Bulletin: Authentication Bypass vulnerability found in IBM Sterling B2B Integrator (CVE-2015-5019)

Summary IBM Sterling B2B Integrator could allow a local mailbox user under specific circumstances to upload or download files without proper authorization. Vulnerability Details CVEID: CVE-2015-5019 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local mailbox user with...

Multiple vulnerabilities in coremail mailbox system

Coremail mail system is a commercial hyperscale operational-grade mail system. There are reflective cross-site scripting and business logic design vulnerabilities in coremail mail system, which can be exploited by attackers to obtain sensitive information from websites and operate across business...

FAQ: Badge Behavior and Notifications Behavior for End Users

This article provides frequently asked questions and answers for Badge behavior and Notifications behavior. Badge Behaviour for End Users Q: What does the badge count represent? A : The badge count represents the total number of unread count of mails for your entire inbox folder. Q: Do I still ha...

SHAttered Attack

apache-james-mailbox-api is vulnerable to the SHAttered attack. Since SHA-1 is used to index attachments, the SHAttered attack could be used to overwrite the attachment of an email using a second email...

LinuxMagic MagicSpam-Plesk Extended Insecure File Permissions Vulnerability

LinuxMagic MagicSpam-Plesk extension is an anti-spam extension from LinuxMagic Canada. A security vulnerability exists in LinuxMagic MagicSpam-Plesk extension version 2.0.13. The vulnerability can be exploited by a local attacker to obtain mailbox names by reading /var/log/magicspam/mslog...

CVE-2018-5693

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog...

Code injection

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog...

CVE-2018-5693

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog...

CVE-2018-5693

The CVE affects LinuxMagic MagicSpam extension for Plesk, versions before 2.0.14-1. Local attackers can disclose mailbox names by reading /var/log/magicspam/mslog, enabling information disclosure on the host. Remediation: upgrade to 2.0.14-1 or newer (as indicated by the vulnerability description).

CVE-2018-5693

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog...

Handy Password Buffer Overflow Vulnerability

Handy Password is a set of password management software based on the Winsows platform. A buffer overflow vulnerability exists in Handy Password version 4.9.3. The vulnerability can be exploited by a remote attacker to execute arbitrary code via the long 'Title name' field in the 'mail box' data...

CVE-2017-17946

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

Mozilla: JavaScript Execution via RSS in mailbox:// origin

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View - Feed article - Website" or in the standard format of "View - Feed article - default format". This vulnerability affects Thunderbird 52.5.2...

MailSploit — Email Spoofing Flaw Affects Over 30 Popular Email Clients

If you receive an email that looks like it's from one of your friends, just beware! It's possible that the email has been sent by someone else in an attempt to compromise your system. A security researcher has discovered a collection of vulnerabilities in more than 30 popular email client...

Logic Design Vulnerability in EasyCMS Frontend

EasyCMS is lightweight scalable open source content management program, following the Apache2 open source agreement. A logical design vulnerability exists in the frontend of EasyCMS. Attackers can log into the user center and modify other people's mailboxes and data by intercepting and modifying...

Mailbox Bombing Vulnerability in the Employment Service Management System of Beijing Rongzhi Chuangxiang Information Technology Co.

The Employment Service Management System is an information interaction system for students, companies, faculty counselors, the Career Center, and their employers. A mailbox bombing vulnerability exists in the Employment Management System of Beijing Rongzhi Chuangxiang Information Technology Co.,...

Unauthorized Content Type Overwriting

Apache James Mailbox API is vulnerable to unauthorized content type overwriting. The vulnerability exists because the application does not link the AttachmentId with the content type in mailbox...

Huawei Vicky-AL00A Mailbox APP suffers from stored XSS vulnerability

The Huawei Vicky-AL00A is a smartphone device from the Chinese company Huawei Huawei. The Huawei Vicky-AL00A Mailbox APP suffers from a stored XSS vulnerability, which can be exploited by a remote attacker to send emails with malicious code due to a lack of sufficient validation of the parameters...

SQL Injection Via Mailbox

genix/cms is susceptible to SQL injection attacks. The vulnerability is possible because it allows attackers to register a new user by using with a chosen ID using a request such as register.php?act=edit=1...

[SECURITY] Fedora 26 Update: cyrus-imapd-3.0.3-1.fc26

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...