Postfix SMTP 4.2.x 4.2.48 - Shellshock Remote Command Injection

Postfix SMTP 4.2.x 4.2.48 - Shellshock Remote Command Injection !/bin/python Exploit Title: Shellshock SMTP Exploit Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bash/ Version: 4.2.x " argc = lensys.argv ifargc 3: usage sys.exit0 rport ...

Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection

!/bin/python Exploit Title: Shellshock SMTP Exploit Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bash/ Version: 4.2.x " argc = lensys.argv ifargc 3: usage sys.exit0 rport = 25 rhost = sys.argv1 cmd = sys.argv2 headers = "To",...

Postfix SMTP Shellshock

!/bin/python Exploit Title: Shellshock SMTP Exploit Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bash/ Version: 4.2.x " argc = lensys.argv ifargc 3: usage sys.exit0 rport = 25 rhost = sys.argv1 cmd = sys.argv2 headers = "To",...

GLSA-201409-09 : Bash: Code Injection (Shellshock)

The remote host is affected by the vulnerability described in GLSA-201409-09 Bash: Code Injection Stephane Chazelas reported that Bash incorrectly handles function definitions, allowing attackers to inject arbitrary code. Impact : A remote attacker could exploit this vulnerability to execute...

[SECURITY] Fedora 21 Update: nginx-1.6.2-2.fc21

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Oracle Linux 5 / 6 / 7 : bash (ELSA-2014-1293)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1293 advisory. 4.1.2-15.1 - Check for fishy environment Resolves: 1141645 Tenable has extracted the preceding description block directly from the Oracle Linux security...

SSL/TLS: SMTP Missing Support For STARTTLS

The remote SMTP server does not support the Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Limitless Keylogger Optimized with AutoIT Infected thousands of Computers

A new surge of malware has been discovered which goes on to infect hundreds of thousands of computers worldwide and allegedly steals users’ social and banking site credentials. Few days back, a list of 5 million combinations of Gmail addresses and passwords were leaked online. The search engine...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

CVE-2012-2588

CVE-2012-2588 is an XSS vulnerability in MailEnable Enterprise 6.5. The issue allows remote attackers to inject arbitrary web script or HTML via SMTP message fields (From, To, Subject) or the message body, exploiting malformed headers/body to execute scripts in a user’s context. Public references...

CVE-2012-2588

Multiple cross-site scripting XSS vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, or 3 Subject header or 4 body in an SMTP e-mail message...

骑士人才系统SQL注入与意外收获

简要描述： 某二次开发系统的SQL注入和74CMS邮箱内容泄漏 详细说明： Google Hacker : inurl:indexgangweixx.php 扔Sqlmap里跑一下： 进后台，发现有SMTP功能： Burp抓个包，直接获取邮箱密码，发现邮箱做了[email protected]邮箱的自动转发： 漏洞证明：...

[SECURITY] Fedora 20 Update: pen-0.25.1-1.fc20

pen is a load balancer for "simple" tcp based protocols such as http or smtp. It allows several servers to appear as one to the outside and automatically detects servers that are down and distributes clients among t he available servers. This gives high availability and scalable performance...

Greenhouse.io: SMTP protection not used (please read carefully )

Details: Companies like Coinbase, Yahoo,Google,Facebook and even hackerone implemented a strict email security policy combining SPF, DKIM, and DMARC but I don't see taht from mailgreenhouse.ioru , You should apply strict SMPT policy to stop spoofed email sending from your domain. POC is attached...

nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngxmailsmtpstarttls' within the file 'src/mail/ngxmailsmtphandler.c' whereby input t...

Exim < 4.83 Math Comparison Functions Data Insertion

According to its banner, the version of Exim running on the remote host is prior to 4.83. It is, therefore, potentially affected by a data insertion vulnerability. A flaw exists in the expansion of arguments to math comparison functions which can cause values to be expanded twice. This could perm...

nginx -- inject commands into SSL session vulnerability

The nginx project reports: Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy CVE-2014-3556; the bug had appeared in 1.5.6...

ThinkSAAS重要敏感信息泄漏

简要描述： ==！ 详细说明： smtp信息泄漏 https://github.com/thinksaas/ThinkSAAS/blob/bf7c544f3f04a5f4ef18f831b4f270049bd3d94c/data/mailoptions.php 利用该帐号重置管理（[email protected]）密码进入管理后台， 密码改为1078700473， 漏洞证明：...

VulnCheck KEV: CVE-2019-25141

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admininit function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to...