625 matches found
CVE-2019-13392
A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...
CVE-2019-13392: Improper Neutralization of Input During Web Page Generation
A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...
DEBIAN-CVE-2019-14664
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...
CVE-2019-13070
A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...
PT-2019-13108
Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0 Description A stored XSS issue in the Agent/Center component allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. This code is executed in the victim's...
PowerPanel Business Edition - Cross-Site Scripting
Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Version: 3.4.0 Tested on: Ubuntu 16.04 CVE : Pending CyberPower PowerPanel Business Edition...
Exim 4.87 - 4.91 - Local Privilege Escalation
!/bin/bash raptoreximwiz - "The Return of the WIZard" LPE exploit Copyright c 2019 Marco Ivaldi A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution. CVE-2019-10149 This...
Exim: Remote command execution
Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description A vulnerability was discovered in how Exim validates recipient addresses in the delivermessage function. Impact A remote attacker could execute arbitrary commands ...
DEBIAN-CVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution...
UBUNTU-CVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution...
CVE-2018-14478
ecard.php in Coppermine Photo Gallery CPG 1.5.46 has XSS via the sendername, recipientemail, greetings, or recipientname parameter...
PT-2019-9026
Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery version 1.5.46 Description The issue concerns an XSS vulnerability in the ecard.php file. It can be exploited via the sender name, recipient email, greetings, or recipient name parameters. Recommendations For Coppermin...
Improper access control checks for share expiration date (NC-SA-2019-002)
A missing check could give recipient the possibility to extend the expiration date of a share they received...
UBUNTU-CVE-2019-10732
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...
CVE-2019-1995
In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure, sending files accessible to AOSP Mail to a remote email recipient, with no additional execution privileges...
Information disclosure
In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure, sending files accessible to AOSP Mail to a remote email recipient, with no additional execution privileges...
VulnCheck KEV: CVE-2019-6223
Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction...
Nextcloud: Share recipient can modify a share's expiration date
Vulnerable URL http://server/nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares/share ID number Summary Nextcloud users can set expiration dates on documents they share with others. However, the function to update a share does not appear to properly validate the requester is the owner when...
Monero: Misreporting of received amount by show_transfers
Summary: A sender may cause showtransfers to report a higher amount that was actually sent on the recipient's showtransfers output. Description: Due to a flaw in processnewtransaction in wallet2.cpp, if the tx pubkey is present multiple times, it will decode outputs correctly as many times, and a...
