Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,374 results · page 28 of 48
Oct 5, 2021The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addressesCVE-2021-22258 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function.CVE-2020-24327 · Other software · Discourse · reported by MITREMedium 5.3
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
- Product
- Ninja Forms
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 16, 2021OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.CVE-2021-27340 · Other software · Os4ed · reported by MITREMedium 6.1
OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021DJ EmailPublish: Reflected Cross-Site ScriptingCVE-2021-38329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
- Product
- DJ EmailPublish
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update DJ EmailPublish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021User Activation Email: Reflected Cross-Site ScriptingCVE-2021-38325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0.
- Product
- User Activation Email
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update User Activation Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 7, 2021Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability inCVE-2021-39122 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Sep 6, 2021It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS.CVE-2021-36093 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
- Product
- Email Encoder – Protect Email Addresses
- Fixed in
- 2.1.2
- What to do
- Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Aug 31, 2021Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.CVE-2021-35220 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.1
Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 30, 2021Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificationCVE-2021-34646 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
- Product
- Booster for WooCommerce
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 25, 2021Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain aCVE-2021-22243 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021A S/MIME issue existed in the handling of encrypted email.CVE-2021-30998 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A S/MIME issue existed in the handling of encrypted email. This issue was addressed with improved selection of the encryption certificate. This issue is fixed in iOS 15.2 and iPadOS 15.2. A sender's email address may be leaked when sending an S/MIME encrypted email using a certificate with more than one email address.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021A S/MIME issue existed in the handling of encrypted email.CVE-2021-30997 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A S/MIME issue existed in the handling of encrypted email. This issue was addressed by not automatically loading some MIME parts. This issue is fixed in iOS 15.2 and iPadOS 15.2. An attacker may be able to recover plaintext contents of an S/MIME-encrypted e-mail.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 23, 2021Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain thaCVE-2021-22251 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a groupCVE-2021-22249 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted CVE-2021-24556 · WordPress plugins & themes · reported by WPScanMedium 6.1
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
- Product
- Email Subscriber
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 18, 2021A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authentCVE-2021-1561 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user. This vulnerability exists because access to the spam quarantine feature is not properly restricted. An attacker could exploit this vulnerability by sending malicious requests to an affected system. A successful exploit could allow the attacker to modify another user's spam quarantine settings, possibly disabling security controls or viewing email messages stored on the spam quarantine interfaces.
- Product
- Cisco Content Security Management Appliance (SMA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 17, 2021In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check.CVE-2021-0642 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-185126149
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 16, 2021Smart Email Alerts: Reflected Cross-Site ScriptingCVE-2021-34642 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10.
- Product
- Smart Email Alerts
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Smart Email Alerts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 6, 2021In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.CVE-2021-37541 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
- Product
- HUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 3, 2021Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via thCVE-2021-33321 · Other software · Liferay · reported by MITREHigh 7.5
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.liferay.comportal.liferay.dev
Aug 2, 2021Bookshelf: Does not sanitise or escape its "Paypal email address" setting before outputting it in the pageCVE-2021-24478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Bookshelf
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Bookshelf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2021SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.CVE-2020-18175 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2021Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.CVE-2021-25273 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.8
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
- Product
- Sophos UTM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgcommunity.sophos.com
Jul 26, 2021It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack.CVE-2021-36092 · Other software · OTRS AG · reported by security@otrs.comMedium 6.5
It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021Agents are able to list customer user emails without required permissions in the bulk action screen.CVE-2021-21443 · Other software · OTRS AG · reported by security@otrs.comLow 3.5
Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgotrs.com
Jul 21, 2021Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone).CVE-2021-2338 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Siebel Apps - Marketing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js.CVE-2021-36716 · Other software · Segment · reported by MITREHigh 7.5
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
- Product
- Is-email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2021WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8: Cross-site request forgery (CSRF)CVE-2021-20779 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8
- Fixed in
- 3.0.8
- What to do
- Update WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 to 3.0.8 or newer.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scriptsCVE-2020-23190 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.CVE-2020-18066 · Other software · Zrlog · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
- Product
- Zrlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed iCVE-2021-23400 · Other software · Nodemailer · reported by report@snyk.ioMedium 6.3
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
- Product
- Nodemailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.CVE-2021-35299 · Other software · Zammad · reported by MITREHigh 7.5
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses.CVE-2021-35525 · Other software · Postsrsd Project · reported by MITREMedium 5.3
PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."
- Product
- Postsrsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orggithub.com
Jun 24, 2021In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.CVE-2020-21783 · Other software · Ibos · reported by MITREMedium 6.1
In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicCVE-2021-29957 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 24, 2021An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent.CVE-2021-23993 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 23, 2021Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.phpCVE-2020-18659 · Other software · Get-simple · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacCVE-2021-20743 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco WebCVE-2021-1566 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
- Product
- Cisco Web Security Appliance (WSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jun 14, 2021DoS attack can be performed when an email contains specially designed URL in the body.CVE-2021-21439 · Other software · OTRS AG · reported by security@otrs.comMedium 6.5
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgotrs.com
Jun 1, 2021The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.CVE-2021-23388 · Other software · Forms Project · reported by report@snyk.ioMedium 5.3
The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
- Product
- Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer.CVE-2020-27748 · Other software · Freedesktop · reported by Red HatMedium 6.5
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
- Product
- Xdg-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgitlab.freedesktop.org
May 27, 2021An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeratCVE-2021-22892 · Other software · Rocket.chat · reported by support@hackerone.comHigh 7.5
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 27, 2021Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html,CVE-2021-33558 · Other software · BOA · reported by MITREHigh 7.5
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notificationsCVE-2020-27831 · Other software · Redhat · reported by Red HatMedium 4.3
A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
- Product
- Quay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 14, 2021ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service.CVE-2021-32816 · Other software · ProtonMail · reported by GitHubMedium 6.5
ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced GHSL-2021-027.
- Product
- WebClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.