Debian DLA-1825-1 : kdepim security update

A reply-based decryption oracle was found in kdepim, which provides the KMail e-mail client. An attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline character...

Mail.ru: Stored xss on message reply

XSS on message reply via double click functionality in web.icq.com...

Design/Logic Flaw

K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within digitally signed reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an...

UBUNTU-CVE-2019-10735

In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

UBUNTU-CVE-2019-10740

In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the...

DEBIAN-CVE-2019-10735

In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

UBUNTU-CVE-2019-10734

In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

UBUNTU-CVE-2019-10732

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the...

CVE-2019-10741

K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within digitally signed reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an...

CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

CVE-2019-6501

CVE-2019-6501 affects QEMU 3.1, where scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c can perform out-of-bounds memory writes/reads. This could allow memory corruption within the QEMU process. The Initial Description provides no explicit details on vulnerable versions beyond QEMU 3.1, nor any...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

Cross site scripting

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

[SECURITY] Fedora 28 Update: perl-Email-Address-List-0.06-1.fc28

Parser for From, To, Cc, Bcc, Reply-To, Sender and previous prefixed with Resent- e.g. Resent-From headers...

Improper Restriction of XML External Entity Reference in bedework:bw-webdav

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...

GHSA-5P52-J8PW-J7X5 Improper Restriction of XML External Entity Reference in bedework:bw-webdav

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...