CVE-2020-7769

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...

DEBIAN-CVE-2020-7769

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...

CVE-2020-14024

CVE-2020-14024 специалисты описывают как у Ozeki NG SMS Gateway до версии 4.17.6 обнаружены несколько XSS-уязвимостей, требующих аутентифицированного доступа: через поля Receiver/Recipient в Mailbox, OZFORM_GROUPNAME в настройках групп адресов, поле listname в Defining Address Lists и через любой...

Description of the Microsoft Office for Mac 2011 14.3.2 Update

Describes the security update for Microsoft Office for Mac 2011 14.3.2, that was released on March12, 2013.IntroductionMicrosoft has released security bulletin MS13-026. This security bulletin contains all the relevant information about the security update for Microsoft Office for Mac 2011. To vi...

OpenSMTPD vulnerable to local privilege escalation and remote code execution

Overview Qualys Research Labs found that the smtpmailaddr function in OpenSMTPD version 6.6 does not properly sanitize user input, which could allow a local attacker to escalate their privileges, and allow either a local or remote attacker to execute arbitrary code as root. Description OpenSMTPD ...

CVE-2020-2094

A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient...

PT-2020-15300 · Cloudbees +1 · Jenkins Health Advisor By Cloudbees Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Health Advisor by CloudBees Plugin versions 3.0 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient. The form validati...

VulnCheck KEV: CVE-2019-10149

Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution...

PT-2019-15927 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.9.2 Description: The issue allows an attacker to crash a push-notification driver with a crafted email when push notifications are used, due to a NULL Pointer Dereference. This can be achieved by using a group...

dovecot -- null pointer deref in notify with empty headers

Aki Tuomi reports Mail with group address as sender will cause a signal 11 crash in push notification drivers. Group address as recipient can cause crash in some drivers...

Unauthorized Access

pimcore/pimcore is vulnerable to unauthorized access. Lack of access checks in certain scenarios whereby an incorrect recipient ID of a notification is submitted, allows unauthorized access to system resources...

CVE-2019-18981

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification...

CVE-2019-18981

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification...

Design/Logic Flaw

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification...

CVE-2019-16949

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat where the user enters in their name and e-mail address. This POST request can be modified to change the message...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

DEBIAN-CVE-2019-14664

In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...

CVE-2019-13070

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

PowerPanel Business Edition - Cross-Site Scripting

Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Version: 3.4.0 Tested on: Ubuntu 16.04 CVE : Pending CyberPower PowerPanel Business Edition...

Exim 4.87 - 4.91 - Local Privilege Escalation

!/bin/bash raptoreximwiz - "The Return of the WIZard" LPE exploit Copyright c 2019 Marco Ivaldi A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution. CVE-2019-10149 This...