Command Execution Vulnerability Exists in OpenSMTPD's

OpenSMTPD is a free implementation of the server-side SMTP protocol , and provides some additional standard extensions . OpenSMTPD's suffers from a command execution vulnerability. An attacker can execute arbitrary shell commands on a vulnerable OpenSMTPD installation...

Debian DSA-4634-1 : opensmtpd - security update

Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of SMTP commands, which could result in local privilege escalation or the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

OpenSMTPD Releases Version 6.6.4p1 to Address a Critical Vulnerability

OpenSMTPD has released version 6.6.4p1 to address a critical vulnerability. A remote attacker could exploit this vulnerability to take control of an affected server. OpenSMTPD is an open-source server-side implementation of the Simple Mail Transfer Protocol SMTP that is part of the OpenBSD Projec...

Nextcloud: Mail does not verify IMAP/SMTP host connected via TLS

The Mail app should verify that the servers it connects to are listed in the certificate's CN. Otherwise the connection should be aborted. Originally reported at https://github.com/nextcloud/mail/issues/308 Impact The app could be forced into connecting to an insecure server...

Apache James Server 2.3.2 Insecure User Creation / Arbitrary File Write

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write", 'Description' = %q This module exploits a vulnerability that exists due t...

OPENSUSE-SU-2020:0231-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 68.5 bsc1162777 MFSA 2020-07 bsc1163368 CVE-2020-6793 bmo1608539 Out-of-bounds read when processing certain email messages CVE-2020-6794 bmo1606619 Setting a master password post-Thunderbird 52 does not delete...

SUSE-SU-2020:0385-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 68.5 bsc1162777 MFSA 2020-07 bsc1163368 CVE-2020-6793 bmo1608539 Out-of-bounds read when processing certain email messages CVE-2020-6794 bmo1606619 Setting a master password post-Thunderbird 52 does not delete...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

OpenRelayMagic - Tool To Find SMTP Servers Vulnerable To Open Relay

╔═╗┌─┐┌─┐┌┐┌╦═╗┌─┐┬ ┌─┐┬ ┬╔╦╗┌─┐┌─┐┬┌─┐ ║ ║├─┘├┤ │││╠╦╝├┤ │ ├─┤└┬┘║║║├─┤│ ┬││ ╚═╝┴ └─┘┘└┘╩╚═└─┘┴─┘┴ ┴ ┴ ╩ ╩┴ ┴└─┘┴└─┘ Tool to test for vulnerable open relays on SMTP servers Features Check single target/ domain list Port 587 and 465 Implemented Multithreaded Download OpenRelayMagic...

Dovecot 2.3.9 < 2.3.9.3 Multiple Vulnerabilities

Dovecot is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

ALPINE-CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

Command injection

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

CVE-2020-7046

CVE-2020-7046 affects Dovecot components lib-smtp (submission-login) and lmtp in 2.3.9 prior to 2.3.9.3, where truncated UTF-8 data in command parameters can be triggered unauthenticated, causing a submission-login infinite loop (DoS). Public references in multiple advisories confirm the vulnerab...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

PT-2020-19354 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions 2.3.9 through 2.3.9.2 Description: The issue is related to the mishandling of truncated UTF-8 data in command parameters by lib-smtp in submission-login and lmtp. This can be demonstrated by the unauthenticated triggering of ...

CVE-2019-19660

The CVE-2019-19660 entry concerns a CSRF vulnerability in the Web File Manager’s Network Settings of Rumpus FTP Server 8.2.9.1 . The issue allows an attacker to manipulate settings such as the SMTP value and other network parameters via RAPR/NetworkSettingsSet.html . Affected component is the Web...

CVE-2019-19660

A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html...