Arbitrary Code Execution

postfix is vulnerable to arbitrary code execution. A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via...

Command Injection

postfix is vulnerable to command injection. It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text...

Denial Of Service (DoS)

fetchmail is vulnerable to denial of service DoS. A flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could...

CVE-2020-11599

An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user...

Default credentials

An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user...

CVE-2020-11599

The CVE-2020-11599 vulnerability affects CIPPlanner CIPAce 6.80 Build 2016031401, where the GetDistributedPOP3 function can expose the SMTP username and password. Multiple sources (e.g., NVD, Red Hat, CNVD) describe an issue that could lead to disclosure of SMTP credentials, resulting in potentia...

CVE-2020-11599

An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user...

ArgoSoft Mail Server Detection (SMTP)

Checks whether ArgoSoft Mail Server is present on the target system and if so, tries to figure out the installed version. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

ArgoSoft Mail Server Detection Consolidation

Consolidation of Argosoft Mail Server detections. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Open-Xchange: Null pointer dereference in SMTP server function smtp_command_parse_data_with_size

Sending the following bytes to the SMTP server induces a NULL pointer dereference...

Open-Xchange: Null pointer dereference in SMTP server function smtp_string_parse

Sending the following bytes to the SMTP server induces a NULL pointer dereference...

Open-Xchange: Use after free in smtp_server_connection_handle_command

Function smtpserverconnectionhandlecommand in src/lib-smtp/smtp-server-connection.c creates a variable named cmd with cmd = smtpservercommandnewtmpconn, cmdname, cmdparams; It gets used with return cmd == NULL || !cmd-inputlocked; ie cmd-inputlocked dereferences the pointer But we can get to this...

How to Collect Veeam ONE SMTP Logging

Purpose This article provides information on enabling extended SMTP email logging, which is necessary when investigating issues with Veeam ONE emails, such as missed alarm notifications, unexpected email content, or other email-related problems. SMTP logging is not enabled by default and must be...

Easy File Sharing Web Server 7.2 Local Buffer Overflow

Exploit Title: Easy File Sharing Web Server 7.2 - SMTP 'Password' Local Buffer Overflow SEH Date: 03/16/2020 Author: Felipe Winsnes Vendor Homepage: http://www.sharing-file.com/ Software Link: http://www.sharing-file.com/download.php Version: 7.2 Tested on: Windows 7 Proof of Concept: 1.- Run the...

Easy File Sharing Web Server 7.2 Local Buffer Overflow Exploit

Exploit Title: Easy File Sharing Web Server 7.2 - SMTP 'Password' Local Buffer Overflow SEH Author: Felipe Winsnes Vendor Homepage: http://www.sharing-file.com/ Software Link: http://www.sharing-file.com/download.php Version: 7.2 Tested on: Windows 7 Proof of Concept: 1.- Run the python script...

Fedora: Security Advisory for opensmtpd (FEDORA-2020-b92d7083ca)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: opensmtpd-6.6.4p1-2.fc32

OpenSMTPD is a FREE implementation of the server-side SMTP protocol as defi ned by RFC 5321, with some additional standard extensions. It allows ordinary machines to exchange e-mails with other systems speaking the SMTP protocol. Started out of dissatisfaction with other implementations, OpenSMTP...

CVE-2020-6980

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol SMTP account data is saved in RSLogix 500, a local attacker with access to a...

Authentication flaw

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol SMTP account data is saved in RSLogix 500, a local attacker with access to a...

CVE-2020-6980

CVE-2020-6980 affects Rockwell Automation products: MicroLogix 1400 Series B (v21.001 and earlier) and Series A, MicroLogix 1100 (all versions), and RSLogix 500 Software (v12.001 and earlier). Root cause: SMTP account data saved in RSLogix 500 project files in cleartext. Consequence: local attack...