Mutt and NeoMutt Arbitrary Command Execution Vulnerability (CNVD-2019-06626)

NeoMutt is a patched version of Mutt, a text-based mail client for Unix-like systems developed by Michael Elkins Software Developers. An arbitrary command execution vulnerability exists in Mutt versions prior to 1.10.1 and NeoMutt versions prior to 2018-07-16, which stems from the fact that mutt...

Mutt and NeoMutt Arbitrary Command Execution Vulnerabilities

NeoMutt is a patched version of Mutt, a text-based mail client for Unix-like systems developed by Michael Elkins Software Developers. An arbitrary command execution vulnerability exists in Mutt versions prior to 1.10.1 and NeoMutt versions prior to 2018-07-16, which stems from a failure of mutt t...

DEBIAN-CVE-2018-14354

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription...

Radancy: I can subscribe and unsubscribe any user with the same token for as many times as i want

During the subscription process for a newsletter it was possible to enter any email-address which would automatically be added to the emaillist without proper confirmation via a confirmation token send by email. Same for the unsubscription process, anyone could unsubscribe all emailaddress becaus...

Improper access control

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in...

CVE-2018-1000503

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in...

CVE-2018-1000503

MyBB before 1.8.15 contains an Incorrect Access Control vulnerability in private forums that can allow viewing private forum posts without a password via an IDOR-like subscribe-to-forum action; fixed in 1.8.15.

Security Bulletin:A security vulnerability has been identified in MySQL Server shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - July 2015)

Summary MySQL Server is shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin...

Liberapay: A single user can subscribe a community multiple times

There is no proper validation while subscribing for a community. A user can subscribe a single community multiple times. Steps to recreate: Step 1: Open any community Step 2: Click on subscribe button Step 3: Capture the POST request and submit it multiple times Step 4: Check the subscription cou...

Beers with Talos EP29 - This is a PSA: Stop Clicking. There is No Prince.

Beers with Talos BWT Podcast Episode 29 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP29 Show Notes: Recorded May 11, 2018 - First and foremost, we recorded this episode one day before ou...

Digium Asterisk Out-of-Bounds Write (CVE-2018-7284)

An out-of-bounds write vulnerability exists in Asterisk. The vulnerability is due to improper processing of SIP SUBSCRIBE requests. Successful exploitation would result in a denial of service condition...

dealhotvn.com XSS vulnerability

Open Bug Bounty ID: OBB-601397 Description| Value ---|--- Affected Website:| dealhotvn.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

app.flashissue.com XSS vulnerability

Open Bug Bounty ID: OBB-600507 Description| Value ---|--- Affected Website:| app.flashissue.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

woodjewel.fi XSS vulnerability

Open Bug Bounty ID: OBB-596999 Description| Value ---|--- Affected Website:| woodjewel.fi Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 27 Update: mosquitto-1.4.15-1.fc27

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

[SECURITY] Fedora 26 Update: mosquitto-1.4.15-1.fc26

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

[SECURITY] Fedora 28 Update: mosquitto-1.4.15-1.fc28

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

subscribe-hr.com XSS vulnerability

Open Bug Bounty ID: OBB-585248 Description| Value ---|--- Affected Website:| subscribe-hr.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...

CVE-2014-2274

Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...