mutt security update

CentOS Errata and Security Advisory CESA-2018:2526 An update for mutt is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Oracle Linux 6 / 7 : mutt (ELSA-2018-2526)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-2526 advisory. 5:1.5.21-28 - Resolves: CVE-2018-14354 CVE-2018-14357 CVE-2018-14362 Tenable has extracted the preceding description block directly from the Oracle...

CentOS 6 / 7 : mutt (CESA-2018:2526)

An update for mutt is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CentOS Update for mutt CESA-2018:2526 centos7

Check the version of mutt SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882938";...

mutt: Remote code injection vulnerability to an IMAP mailbox

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription...

Important: Red Hat Security Advisory: mutt security update

An update for mutt is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

RHEL 6 / 7 : mutt (RHSA-2018:2526)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2526 advisory. Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and...

Cross site scripting

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

CVE-2018-13055

CVE-2018-13055 family (MantisBT) : The cross‑site scripting flaw affects MantisBT 2.1.0–2.15.0 (and related advisories) via PATH_INFO on the View Filters page (view_filters_page.php) and related Edit Filter paths, caused by an incomplete fix for this issue. Connected entries reiterate the same XS...

CVE-2018-14513

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...

CVE-2018-14512

The CVE-2018-14512 issue affects WUZHI CMS 4.1.0 . A persistent XSS exists in the API endpoint captured as index.php?m=core&f=set&v=sendmail, triggered when the administrator accesses the system settings - mail server screen. The vulnerability is exploitable via the form[nickname] parameter, allo...

CVE-2018-14512

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

Linux Driver National Instruments Remote Code Injection Vulnerability

Exploit for linux platform in category remote exploits Hello , i've recently discovered a critical vulnerability in the National Instruments Linux driver package, which opens up an remote code injection software update vulnerability. Classification: CRITICAL / 0day - easily exploitable Impact:...

IBM Rational DOORS Next Generation and IBM Rational Requirements Composer Cross-Site Scripting Vulnerabilities

IBM Rational DOORS Next Generation DNG and Rational Requirements Composer RRC are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability exists in IB...

FreeBSD : mutt -- remote code injection and path traversal vulnerability (a2f35081-8a02-11e8-8fa5-4437e6ad11c4)

Kevin J. McCarthy reports : Fixes a remote code injection vulnerability when 'subscribing' to an IMAP mailbox, either via $imapchecksubscribed, or via the function in the browser menu. Mutt was generating a 'mailboxes' command and sending that along to the muttrc parser. However, it was not...

mutt -- remote code injection and path traversal vulnerability

Kevin J. McCarthy reports: Fixes a remote code injection vulnerability when "subscribing" to an IMAP mailbox, either via $imapchecksubscribed, or via the function in the browser menu. Mutt was generating a "mailboxes" command and sending that along to the muttrc parser. However, it was not escapi...

CVE-2016-9483

CVE-2016-9483 involves PHP FormMail Generator-generated PHP form code where phpfmg_filman_download() deserializes untrusted input, enabling a remote, unauthenticated attacker to inject PHP code. The description notes that, combined with CVE-2016-9484, this can lead to local file inclusion attacks...

InvoicePlane cross-site scripting vulnerability (CNVD-2018-13195)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.5.10. A remote attacker can exploit this vulnerability by injecting malicious code into the application with the...

mantis -- multiple vulnerabilities

mantis reports: Teun Beijers reported a cross-site scripting XSS vulnerability in the Edit Filter page which allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name. Prevent the attack by sanitizing the filter name before display. Ömer Cıtak,...

CVE-2018-8284

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2,...