Updated php-phpmailer packages fix CVE-2015-8476

Updated php-phpmailer package fixes security vulnerability: Takeshi Terada discovered that PHPMailer accepted addresses containing line breaks. This is valid in RFC5322, but allowing such addresses resulted in invalid RFC5321 SMTP commands, permitting a kind of message injection attack...

[SECURITY] [DSA 3416-1] libphp-phpmailer security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3416-1 [email protected] https://www.debian.org/security/ Luciano Bello December 13, 2015 https://www.debian.org/security/faq -...

PHPmailer -- SMTP injection vulnerability

PHPMailer changelog reports: Fix vulnerability that allowed email addresses with line breaks valid in RFC5322 to pass to SMTP, permitting message injection at the SMTP level. Mitigated in both the address validator and in the lower-level SMTP class. Thanks to Takeshi Terada...

Unspecified Vulnerability in Pivotal Software Spring Framework Java SockJS Client

Pivotal Software Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A security vulnerability exists in the Java SockJS client in Pivotal Software Spring Framework version...

ChatSecure IM 2.2.4 Script Insertion

Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 13...

CVE-2014-2968

Cross-site scripting XSS vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message...

Google Chrome < 34.0.1847.116 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 34.0.1847.116. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the included Flash version that could lead to arbitrary code execution. CVE-2014-0506 - A buffer overflow...

Docebo LMS <= v4.0.4 (messages) Remote Code Execution

Exploit for php platform in category web applications if$GLOBALS'modname' != ''...

Apache Tomcat 5.5.x < 5.5.34 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.34. It is, there, affected by multiple vulnerabilities : - Several weaknesses were found in the HTTP Digest authentication implementation. The issues are as follows:...

CVE-2005-2460

Multiple cross-site scripting XSS vulnerabilities in Kayako liveResponse 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter or 2 name field when entering a session or sending a message...

CVE-2001-1441

Cross-site scripting XSS vulnerability in VisualAge for Java 3.5 Professional allows remote attackers to execute JavaScript on other clients via the URL, which injects the script in the resulting error message...

CVE-2005-0476

Cross-site scripting XSS vulnerability in hpmguestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message...

RemotelyAnywhere - Default.HTML Logout Message Injection

RemotelyAnywhere - Default.HTML Logout Message Injection source: https://www.securityfocus.com/bid/9202/info RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by...

RemotelyAnywhere - Default.HTML Logout Message Injection

source: https://www.securityfocus.com/bid/9202/info RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by RemotelyAnywhere on user supplied 'reason' URI parameters...

gaimexploit.txt

It has come to my attention that people have actually used this example code for a gaim plugin: AIM::register"Festival TTS", "0.0.1", "goodbye", ""; AIM::print"Perl Says", "Loaded Festival TTS"; AIM::command"idle", "60000" if $pro ne "Offline"; AIM::addeventhandler"eventimrecv", "synthesize"; sub...

CVE-2002-0980

The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL...

CVE-1999-1033

Microsoft Outlook Express before 4.72.3612.1700 allows a malicious user to send a message that contains a .., which can inadvertently cause Outlook to re-enter POP3 command mode and cause the POP3 session to hang...

POP3Lite 0.2.3b minor client side DoS and message injection

vulnerable POP3Lite = 0.2.3b not vulnerable POP3Lite = 0.2.4 abstract POP3Lite is a modular POP3 daemon developed to be fast, flexible and easy to use. It runs on Linux and BSD. POP3Lite fails to escape dots in messages it transfers to clients. Clients popping their mail from a vulnerable POP3Lit...

O&#39;Reilly WebBoard 4.10.30 JavaScript code execution problem

I found following problem in the WebBoard: The Board has a paging function. User A can send a message to user B. User B gets a javascript popup produced with alert with the message from user A. The problem is that user A can close the alert function and so he can execute his javascript code on us...