Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,709 results · page 37 of 115
Mar 13, 2024In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completionCVE-2023-52608 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a transaction which is still pending, the related payload is fetched too. When an SCMI command times out the channel ownership remains with the platform until eventually a late reply is received and, as a consequence, any further transmission attempt remains pending, waiting for the channel to be relinquished by the platform. Once that late reply is received the channel ownership is given back to the agent and any pending request is then allowed to proceed and overwrite the SMT area of the just delivered late reply; then the wait for the reply to the new request starts. It has been observed that the spurious IRQ related to the late reply can be wrongly associated with the freshly enqueued request: when that happens the SCMI stack in-flight lookup procedure is fooled by the fact that the message header now present in the SMT area is related to the new pending transaction, even though the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 12, 2024SQL injection vulnerability in Employee Management System v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to the txtemail paCVE-2024-25325 · Other software · Walterjnr1 · reported by MITREHigh 7.1
SQL injection vulnerability in Employee Management System v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to the txtemail parameter in the login.php.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Mar 11, 2024Seriously Simple Podcasting: Discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted requestCVE-2023-6444 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
- Product
- Seriously Simple Podcasting
- Fixed in
- 3.0.0
- What to do
- Update Seriously Simple Podcasting to 3.0.0 or newer.
Mar 9, 2024An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.CVE-2024-25501 · Other software · winmail_project · reported by MITREHigh 8.8
An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.
- Product
- winmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized email sendingCVE-2024-1124 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 5, 2024The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.CVE-2024-24784 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
- Product
- net/mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024 Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injectCVE-2024-21838 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 6.8
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.
- Product
- Command Centre Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Mar 4, 2024Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.CVE-2023-49546 · Other software · sourcecodester · reported by MITREHigh 8.8
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.
- Product
- customer_support_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 4, 2024The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache.CVE-2024-1936 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Mar 1, 2024File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameteCVE-2024-27747 · Other software · sourcecodester · reported by MITRECritical 9.8
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address paraCVE-2024-27746 · Other software · sourcecodester · reported by MITRECritical 9.8
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server.CVE-2024-1619 · Other software · Kaspersky · reported by vulnerability@kaspersky.comMedium 6.1
Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions.
- Product
- Kaspersky Security for Linux Mail Server 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comsupport.kaspersky.com
Feb 28, 2024Email Before Download: Cross-Site Request Forgery (CSRF)CVE-2024-23519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7.
- Product
- Email Before Download
- Affected
- up to 6.9.7
- What to do
- Affects up to 6.9.7. Update Email Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.CVE-2024-21725 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 28, 2024Email Encoder – Protect Email Addresses and Phone Numbers: Stored Cross-Site ScriptingCVE-2024-1282 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Encoder – Protect Email Addresses and Phone Numbers
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Email Encoder – Protect Email Addresses and Phone Numbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email paCVE-2024-25866 · Other software · codeastro · reported by MITREHigh 8.8
A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component.
- Product
- membership_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024MailerLite – WooCommerce integration: Cross-Site Request Forgery (CSRF)CVE-2023-52223 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
- Product
- MailerLite – WooCommerce integration
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 22, 2024The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet.CVE-2024-26151 · Other software · FelixSchwarz · reported by GitHubHigh 8.2
The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `<script>` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.
- Product
- mjml-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.CVE-2024-26318 · Other software · Serenity · reported by MITREMedium 6.1
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
- Product
- Serenity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordserenity.isserenity.is
Feb 18, 2024Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availabilityCVE-2023-52381 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 18, 2024Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-52380 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 14, 2024Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php.CVE-2024-25216 · Other software · Sherlock · reported by MITRECritical 9.8
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at CVE-2024-25214 · Other software · sherlock · reported by MITRECritical 9.8
An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.
- Product
- employee_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024A user changing their email after signing up and verifying it can change it without verification in profile settings.CVE-2023-6152 · Other software · Grafana · reported by security@grafana.comMedium 5.4
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.CVE-2023-26562 · Email & office · Zimbra · reported by MITREMedium 6.5
In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Feb 13, 2024SMTP Mail: Cross-Site Request Forgery (CSRF)CVE-2024-25914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20.
- Product
- SMTP Mail
- Affected
- up to 1.3.20
- What to do
- Affects up to 1.3.20. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 12, 2024Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.CVE-2024-23761 · Other software · gambio · reported by MITRECritical 9.8
Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.
- Product
- gambio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Feb 12, 2024Processing of user-defined mail search expressions is not limited.CVE-2023-41707 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Feb 12, 2024Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.CVE-2023-41704 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.1
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Feb 9, 2024Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s).CVE-2023-39683 · Other software · Zalify · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version.
- Product
- Easy Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewingCVE-2023-49101 · Other software · Axigen · reported by MITREMedium 6.1
WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates.
- Product
- Axigen Mobile Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_iCVE-2023-48974 · Other software · Axigen · reported by MITRECritical 9.6
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
- Product
- Axigen Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.CVE-2024-24133 · Other software · atmail · reported by MITRECritical 9.8
Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
- Product
- atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.CVE-2024-24131 · Other software · Superwebmailer · reported by MITREMedium 6.1
SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/loCVE-2024-24130 · Other software · mail2world · reported by MITREMedium 6.1
Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/login.asp.
- Product
- mail2world
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction.CVE-2024-24304 · Other software · Sinch · reported by MITREHigh 7.5
In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction.
- Product
- Mailjet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.friendsofpresta.org
Feb 7, 2024Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attCVE-2023-40355 · Other software · Axigen · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
- Product
- Axigen Mobile Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emailsCVE-2024-24595 · Other software · Allegro.AI · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cMedium 6
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.
- Product
- ClearML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhiddenlayer.comhiddenlayer.com
Feb 2, 2024mailcow is a dockerized email package, with multiple containers linked in one bridged network.CVE-2024-24760 · Other software · mailcow · reported by GitHubHigh 8.8
mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024mailcow is a dockerized email package, with multiple containers linked in one bridged network.CVE-2024-23824 · Other software · mailcow · reported by GitHubMedium 4.7
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51532 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.19.
- Product
- Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024FreshMail For: Cross-Site Request Forgery (CSRF)CVE-2024-22304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
- Product
- FreshMail For
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update FreshMail For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 30, 2024An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0.CVE-2024-22646 · Other software · Seopanel · reported by MITREMedium 5.3
An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exist on the system.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Restrict Usernames Emails Characters
- Fixed in
- 3.1.4
- What to do
- Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Jan 28, 2024The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue to CVE-2004-1558.CVE-2024-24736 · Other software · Ypopsemail · reported by MITREHigh 7.5
The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue to CVE-2004-1558.
- Product
- Ypops!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 25, 2024Tuta is an encrypted email service.CVE-2024-23655 · Other software · tutao · reported by GitHubHigh 7.5
Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.
- Product
- tutanota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Contact Form 7 Extension For Mailchimp: Server-Side Request Forgery (SSRF)CVE-2024-22134 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
- Product
- Contact Form 7 Extension For Mailchimp
- Affected
- up to 0.5.70
- What to do
- Affects up to 0.5.70. Update Contact Form 7 Extension For Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 23, 2024Tuta is an encrypted email service.CVE-2024-23330 · Other software · tutao · reported by GitHubMedium 5.3
Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.
- Product
- tutanota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command.CVE-2020-36772 · Other software · Cloudlinux OS · reported by Red HatMedium 4.4
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.
- Product
- cagefs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 18, 2024A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file.CVE-2023-43817 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 7.5
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.