CVE-2018-1294

CVE-2018-1294 affects Apache Commons-Email: when unvalidated input is used as the Bounce Address and contains line breaks, email details (recipients, contents, etc.) may be manipulated. The risk is mitigated by upgrading to Commons-Email 1.5 or by stripping line breaks from data passed to Email.s...

CVE-2017-9801

CVE-2017-9801 affects Apache Commons Email (versions 1.0–1.4). A call-site passing an email subject containing line-breaks can be exploited to inject arbitrary SMTP headers, due to a flaw in how setSubject handles input. This can lead to SMTP header manipulation and potential information exposure...