Design/Logic Flaw

Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/emlviewer/email.content.body.php?filesystempath=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server...

Sql injection

Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMERIDINNER=1 /admin/emailrichment/userlist.php?CUSTOMERIDINNER=1 /manage/emailrichment/usersunlist.php?CUSTOMERIDINNER=1...

CVE-2022-22793 Cybonet - PineApp Mail Relay Local File Inclusion

Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/emlviewer/email.content.body.php?filesystempath=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server...

CVE-2022-22793

CVE-2022-22793 affects Cybonet PineApp Mail Relay via a Local File Inclusion in the /manage/mailpolicymtm/log/eml_viewer/email.content.body.php endpoint, exploitable by supplying a crafted filesystem_path to read local server files. The issue is documented across multiple sources (NVD/NVD mirror,...

CVE-2022-22794 Cybonet - PineApp Mail Relay Unauthenticated Sql Injection

Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMERIDINNER=1 /admin/emailrichment/userlist.php?CUSTOMERIDINNER=1 /manage/emailrichment/usersunlist.php?CUSTOMERIDINNER=1...

CVE-2022-22794

Cybonet PineApp Mail Relay is affected by an unauthenticated SQL injection vulnerability. The flaw allows an attacker to craft requests to endpoints such as /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1, /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1, /manage/emailrichment/usersun...

Cybonet PineApp Mail Secure SQL注入漏洞

Cybonet PineApp Mail Secure is Cybonet Israel's solution for blocking most malicious email threats at the network perimeter, while providing a range of additional options for comprehensive security and messaging control.Cybonet PineApp Mail Relay is vulnerable to a SQL injection vulnerability tha...

PT-2022-15682 · Cybonet · Cybonet Pineapp Mail Relay

Name of the Vulnerable Software and Affected Versions: Cybonet PineApp Mail Relay affected versions not specified Description: The issue allows an attacker to send a request to the "/manage/mailpolicymtm/log/eml viewer/email.content.body.php" API endpoint with a filesystem path parameter set to a...

Dropping Files on a Domain Controller Using CVE-2021-43893

On December 14, 2021, during the Log4Shell chaos, Microsoft published CVE-2021-43893, a remote privilege escalation vulnerability affecting the Windows Encrypted File System EFS. The vulnerability was credited to James Forshaw of Google Project Zero, but perhaps owing to the Log4Shell atmosphere,...

CVE-2022-22794

Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMERIDINNER=1 /admin/emailrichment/userlist.php?CUSTOMERIDINNER=1 /manage/emailrichment/usersunlist.php?CUSTOMERIDINNER=1...

CVE-2022-22793

Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/emlviewer/email.content.body.php?filesystempath=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server...

Metasploit Wrap-Up

Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...

Voltage SecureMail Server Business Logic Bypass Vulnerability

======================================================================= title: Business Logic Bypass - Mail Relay Post-authenticated product: Voltage SecureMail Server vulnerable version: Voltage SecureMail Server v7.3.0.1 fixed version: Voltage SecureMail Server v7.3.0.1 CVE number: CVE-2021-381...

CVE-2021-38130

A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability could be exploited to create an information leakage attack...

CVE-2021-38130

A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability could be exploited to create an information leakage attack...

CVE-2021-38130

A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability could be exploited to create an information leakage attack...

Micro Focus Voltage SecureMail Server 安全漏洞

Micro Focus Voltage SecureMail Server is a Saas-secure email encryption solution from Micro Focus UK. A security vulnerability exists in Micro Focus Voltage SecureMail Mail Relay versions prior to 7.3.0.1, which stems from a lack of protection for sensitive information in the software. The...

Voltage SecureMail Server Business Logic Bypass

Security Advisory ======================================================================= title: Business Logic Bypass - Mail Relay Post-authenticated product: Voltage SecureMail Server vulnerable version: Voltage SecureMail Server v7.3.0.1 fixed version: Voltage SecureMail Server v7.3.0.1 CVE...

Schneider Electric Easergy P3 缓冲区错误漏洞

The Schneider Electric Easergy P3 is an easy-to-use protective relay from Schneider Electric France. A buffer error vulnerability exists in the Schneider Electric Easergy P3. The vulnerability stems from the presence of a buffer copying vulnerability that does not check the input size, which coul...

PT-2022-10694 · Micro Focus · Micro Focus Voltage Securemail Mail Relay +1

Name of the Vulnerable Software and Affected Versions: Micro Focus Voltage SecureMail Mail Relay versions prior to 7.3.0.1 Description: A potential information leakage issue has been identified. This could be exploited to create an information leakage attack. The issue is related to a business...