CVE-2019-10732

CVE-2019-10732 affects KDE PIM’s messagelib/KMail: an attacker who has S/MIME or PGP encrypted emails can wrap the ciphertext in a crafted multipart message; by hiding parts with HTML/CSS or newline tricks, the attacker can cause the recipient to leak plaintext back when replying. Connected advis...

CVE-2019-10732

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

CVE-2019-10732

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

openSUSE Security Update : Mozilla Thunderbird (openSUSE-2019-503)

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base MFSA 2018-16, bsc1098998 : - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus -...

openSUSE Security Update : enigmail (openSUSE-2019-396)

This update for enigmail to version 2.0.6 fixes the following issues : Security issues fixed : - Replies to a partially encrypted message may have revealed protected information: no longer display PGP/MIME message part followed by unencrypted data boo1094781 - Signature could be spoofed via...

UBUNTU-CVE-2018-15586

Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email...

DEBIAN-CVE-2018-15587

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment...

DEBIAN-CVE-2018-15586

Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email...

UBUNTU-CVE-2018-15587

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment...

WordPress YOP Poll 6.0.2 Cross Site Scripting

Vulnerability: XSS Affected Software: YOP Poll Affected Version: 6.0.2 Patched Version: 6.0.3 CVE: not requested Risk: Medium Vendor Contacted: 10/25/2018 Vendor Fix: 11/26/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Overview Th...

WordPress Contact Form Email 1.2.65 CSRF / Cross Site Scripting

Vulnerability: XSS & CSRF Affected Software: Contact Form Email Affected Version: 1.2.65 Patched Version: 1.2.66 CVE: not requested Risk: Medium Vendor Contacted: 10/31/2018 Vendor Fix: 10/31/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen Reflected XSS CVSS 6.1 Medium...

WordPress KingComposer 2.7.6 Cross Site Scripting

Vulnerability: XSS Affected Software: KingComposer Affected Version: 2.7.6 Patched Version: none CVE: not requested Risk: Medium Vendor Contacted: 10/25/2018 Vendor Fix: none Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Overview The...

WordPress WP Live Chat 8.0.18 Cross Site Scripting

Vulnerability: XSS Affected Software: WP Live Chat Support Affected Version: 8.0.18 Patched Version: CVE: not requested Risk: Medium Vendor Contacted: 10/31/2018 Vendor Fix: 11/01/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

WordPress Quiz And Survey Master 6.0.4 Cross Site Scripting

Vulnerability: XSS Affected Software: Quiz And Survey Master Affected Version: 6.0.4 Patched Version: none CVE: not requested Risk: Medium Vendor Contacted: 10/25/2018 Vendor Fix: none Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

[SECURITY] [DLA 1658-1] phpmyadmin security update

Package : phpmyadmin Version : 4:4.2.12-2+deb8u4 CVE ID : CVE-2018-19968 CVE-2018-19970 A couple of vulnerabilities have been discovered in phpmyadmin, MySQL web administration tool. CVE-2018-19968 An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an...

Sn0Int - Semi-automatic OSINT Framework And Package Manager

sn0int is a semi-automatic OSINT framework and package manager. It was built for IT security professionals and bug hunters to gather intelligence about a given target or about yourself. sn0int is enumerating attack surface by semi-automatically processing public information and mapping the result...

About the security content of iCloud for Windows 7.9 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of iCloud for Windows 7.7 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

[SECURITY] [DLA 1638-1] libjpeg-turbo security update

Package : libjpeg-turbo Version : 1:1.3.1-12+deb8u1 CVE ID : CVE-2016-3616 CVE-2018-1152 CVE-2018-11212 CVE-2018-11213 CVE-2018-11214 Debian Bug : 819969 902950 902176 Several vulnerabilities have been resolved in libjpeg-turbo, Debians default JPEG implemenation. CVE-2016-3616 The cjpeg utility ...

Intel Corporation: [FG-VD-19-009] Intel(R) Trace Analyzer and Collector 2019 Memory Corruption Vulnerability Notification

The Vulnerability Report along with PoC file has been shared in the PGP encrypted using Intel Public Key Attachment along with this report. Impact Memory Corruption & Arbitrary Code Execution...