PT-2023-22990 · WordPress · Post Smtp

Name of the Vulnerable Software and Affected Versions: Post SMTP plugin for WordPress versions up to, and including, 2.5.7 Description: The issue is related to Stored Cross-Site Scripting via email contents due to insufficient input sanitization and output escaping. This allows unauthenticated...

WordPress Plugin Post SMTP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Post SMTP Plugin <= 2.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.5.7 Fixed in 2.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3082 Patch priority Low CVSS severity Low 7.1 Developer WPExperts PSID c8d98d03e5dd Credits Alex Thomas Required privilege...

WordPress Plugin SMTP Mail 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-23050 · WordPress · Smtp Mail

Name of the Vulnerable Software and Affected Versions: SMTP Mail plugin for WordPress versions up to, and including, 1.2.16 Description: The issue is related to Stored Cross-Site Scripting via an email subject due to insufficient input sanitization and output escaping when the 'Save Data SendMail...

WordPress SMTP Mail Plugin <= 1.3.36 is vulnerable to Cross Site Scripting (XSS)

Software SMTP Mail Type Plugin Vulnerable versions = 1.3.36 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3092 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 4ad93cce1cf5 Credits Alex Thomas Required privilege...

SMTP Mail <= 1.2.16 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitize and escape input in email subjects when the 'Save Data SendMail' feature is enabled, leading to potential Stored Cross-Site Scripting issues...

WordPress Post SMTP Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post SMTP Type Plugin Vulnerable versions 2.5.7 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3179 Patch priority Low CVSS severity Low 8.8 Developer WPExperts PSID a42127c2ce5a Credits Erwan LR WPScan Required privilege...

WordPress Post SMTP Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post SMTP Type Plugin Vulnerable versions 2.5.7 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3178 Patch priority Low CVSS severity Low 5.4 Developer WPExperts PSID 120e0e7d693e Credits Erwan LR WPScan Required privilege...

CLSA-2023-1688070370 Fix CVE(s): CVE-2021-38371

SECURITY UPDATE: Response injection buffering during MTA SMTP sending - debian/patches/CVE-2021-38371.patch: Enforce STARTTLS sync point, client side in src/transports/smtp.c - CVE-2021-38371...

CLSA-2023-1687795205 exim: Fix of CVE-2021-38371

CVE-2021-38371: Enforce STARTTLS sync point, client side in src/transports/smtp.c...

CLSA-2023-1687794906 exim: Fix of CVE-2021-38371

CVE-2021-38371: Enforce STARTTLS sync point, client side in src/transports/smtp.c...

POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability delete arbitrary logs via a CSRF attack. Note: The AJAX actions are also affected by SQL injections, making the issue Make a logged in users...

POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability delete arbitrary logs via a CSRF attack. Note: The AJAX actions are also affected by SQL injections, making the issue PoC Make a logged in...

POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability resend an email to an arbitrary address for example a password reset email could be resent to an attacker controlled email, and allow them to...

POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability resend an email to an arbitrary address for example a password reset email could be resent to an attacker controlled email, and allow them to...

CVE-2023-34673

Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases...

CVE-2023-34673

Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases...

Code injection

Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases...

CVE-2023-34465

XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, Mail.MailConfig can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending...