Command injection

The STARTTLS implementation in mail/ngxmailsmtphandler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command...

CVE-2014-3556

The STARTTLS implementation in mail/ngxmailsmtphandler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command...

CVE-2014-3556

The STARTTLS implementation in mail/ngxmailsmtphandler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command...

CVE-2014-3556

The CVE-2014-3556 entry affects nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4. The STARTTLS implementation in mail/ngx_mail_smtp_handler.c allows an MITM to inject commands into encrypted SMTP sessions by sending a cleartext command after TLS is established, due to insufficient I/O bu...

Apache James Server 2.3.2 - Remote Command Execution

Apache James Server 2.3.2 - Remote Command Execution !/usr/bin/python Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec Vendor Homepage: http://james.apache.org/server/ Software...

Apache James Server 2.3.2 - Remote Command Execution

!/usr/bin/python Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec Vendor Homepage: http://james.apache.org/server/ Software Link:...

THC-Hydra 8.1 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

How to configure Email Notifications when using Gmail or Google Apps Mail

Solution Select the product below to be taken to the product-specific information for using Google Gmail to send email notifications. Veeam Backup & Replication v12 Veeam Backup & Replication v13 Veeam ONE v12 Veeam ONE v13 Veeam Backup for Microsoft 365 v7+ Veeam Agent for Microsoft Windows v6+...

FluxBB 1.5.6 SQL Injection Exploit

Exploit for php platform in category web applications !/usr/bin/env python Friday, November 21, 2014 - email protected FluxBB 80: sys.exit'SQL too long, max 80 chars' print "1st stage: %s %d chars" % sql, lensql r = urlopenRequest'%sprofile.php?action=changeemail&id=%s' % url, uid,...

FluxBB 1.5.6 - SQL Injection

FluxBB 1.5.6 - SQL Injection !/usr/bin/env python Friday, November 21, 2014 - secthrowaway safe-mail net FluxBB 80: sys.exit'SQL too long, max 80 chars' print "1st stage: %s %d chars" % sql, lensql r = urlopenRequest'%sprofile.php?action=changeemail&id=%s' % url, uid,...

SMTP NTLM Domain Extraction

Extract the Windows domain name from an SMTP NTLM challenge. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMTP NTLM Domain Extraction', 'Description' = 'Extract the Windows domain name from ...

[SECURITY] Fedora 20 Update: curl-7.32.0-15.fc20

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Scalix Detection (HTTP, SMTP, IMAP)

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Bash broken shell vulnerability ShellShock and Transfiguration: for the mail server SMTP attack-vulnerability warning-the black bar safety net

Bash broken shell vulnerability, ShellShock, CVE-2 0 1 4-6 2 7 1 new using the method again! According to the Internet storm center SANS InternetStorm Center for the latest news: a broken shell vulnerability the latest The use of the method of initiation of a new round of attack is brewing, this...

Shellshock Exploits Used Against SMTP Servers at Webhosts

The persistence of the Shellshock vulnerability remains high more than a month after it first surfaced. The latest attacks involved SMTP servers belonging to web hosts, said a report published by the SANS Internet Storm Center. Attackers are using Shellshock exploits targeting the now infamous...

CVE-2013-6796

The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind...

Authentication flaw

The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind...

CVE-2013-6796

The CVE-2013-6796 entry concerns the SMTP server in DeepOfix 3.3 and earlier, where an empty password allows remote attackers to bypass authentication, triggering an LDAP anonymous bind. The vulnerability is documented across multiple sources (NVD, CVE lists, and OpenVAS) with a consistent descri...

CVE-2013-6796

The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind...

Facebook Yahoo Require-Recipient-Valid-Since SMTP Extension

Yahoo’s decision in June 2013 to reset accounts that had been dormant for 12 months and make them available to other users raised a number of security and privacy red flags. It was feared that the potential for identity theft would grow given that if an old Yahoo account was linked to another...