267 matches found
CVE-2021-31222
SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed...
CVE-2021-31223
SES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration console installed...
CVE-2021-24494
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the...
CVE-2025-32792
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...
Unintended Scope Exposure
SES is vulnerable to unintended scope exposure. The vulnerability is due to improper isolation due to top-level let, const, or class bindings in...
CVE-2025-32792
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...
CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...
CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...
CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...
@5minds/processcube_engine (>=19.0.0-beta.8, <=20.0.0-renovate-fd1892-me5sbqz0), @bitcoin-computer/components (>=0.24.1-beta.0, <=0.26.0-beta.0) +8 more potentially affected by CVE-2025-32792 via ses (>=1.0.0, <=1.11.0)
ses NPM version =1.0.0, =19.0.0-beta.8, =0.24.1-beta.0, =0.18.0-beta.0, =4.4.0, =0.0.1, =0.3.0-beta.0, =4.3.0-alpha.1, =4.5.0, =16.2.0, =16.3.2 Source cves: CVE-2025-32792 Source advisory: OSV:GHSA-H9W6-F932-GQ62...
GHSA-H9W6-F932-GQ62 ses's global contour bindings leak into Compartment lexical scope
Impact Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a tag will have inadvertently revealed these bindings in the lexical scope...
ses's global contour bindings leak into Compartment lexical scope
Impact Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a tag will have inadvertently revealed these bindings in the lexical scope...
npm SES 安全漏洞
npm SES is a library from the US company npm. A security vulnerability exists in npm SES versions prior to 1.12.0 that stems from third-party code that may access top-level bindings...
PT-2025-17316 · Ses · Ses
Name of the Vulnerable Software and Affected Versions: SES versions prior to 1.12.0 Description: The issue arises when using the SES and Compartment API to evaluate third-party code in an isolated environment. In versions prior to 1.12.0, top-level let, const, and class bindings in tags are...
CVE-2025-3434
The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-3434
The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
WordPress SMTP for Amazon SES – YaySMTP plugin <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability
Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by zer0gh0st in WordPress Plugin SMTP for Amazon SES versions = 1.8...
CVE-2025-0957
The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...
CVE-2025-0957 Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...
CVE-2025-0957
CVE-2025-0957 : The WordPress plugin “SMTP for Amazon SES – YaySMTP” is vulnerable to unauthenticated stored XSS up to version 1.7.1 due to insufficient input sanitization and output escaping. This allows an attacker to inject scripts on pages that execute when a user visits the page. Affected p...