Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,712 results · page 41 of 115
Aug 18, 2023Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail CVE-2023-39415 · Other software · North Grid Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation.
- Product
- Proself Enterprise/Standard Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39974 · Other software · acymailing.com · reported by security@joomla.orgMedium 5.3
Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39973 · Other software · acymailing.com · reported by security@joomla.orgMedium 4.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39972 · Other software · acymailing.com · reported by security@joomla.orgMedium 4.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS.CVE-2023-39971 · Other software · acymailing.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla.CVE-2023-39970 · Other software · acymailing.com · reported by security@joomla.orgCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.
- Product
- AcyMailing component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 17, 2023EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.CVE-2023-40281 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 4.8
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
- Product
- EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023WP-EMail: Does not sanitise and escape some of its settingsCVE-2023-3721 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP-EMail
- Fixed in
- 2.69.1
- What to do
- Update WP-EMail to 2.69.1 or newer.
Aug 11, 2023SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.CVE-2020-36136 · Other software · Cskaza · reported by MITREHigh 7.5
SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link.CVE-2020-24904 · Other software · Davesteele · reported by MITREMedium 6.5
An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link.
- Product
- Gnome-gmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.CVE-2023-36314 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
- Product
- Callback Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 9, 2023A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.CVE-2023-38348 · Other software · Lw-systems · reported by MITREHigh 8.8
A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
- Product
- Benno Mailarchiv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sebastianschmitt.euwiki.benno-mailarchiv.de
Aug 9, 2023An issue was discovered in LWsystems Benno MailArchiv 2.10.1.CVE-2023-38347 · Other software · Lw-systems · reported by MITREMedium 6.1
An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.
- Product
- Benno Mailarchiv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sebastianschmitt.euwiki.benno-mailarchiv.de
Aug 9, 2023A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dCVE-2022-48594 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
- Product
- SL 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurifera.comsecurifera.com
Aug 7, 2023Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilCVE-2023-38932 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function.
- Product
- f1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Qubely: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX actionCVE-2021-24916 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
- Product
- Qubely
- Fixed in
- 1.8.6
- What to do
- Update Qubely to 1.8.6 or newer.
Aug 4, 2023A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2020-26082 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected zip files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Aug 3, 2023In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers CVE-2023-36139 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- Product
- Cleaning Business Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 3, 2023In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers toCVE-2023-36134 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- Product
- Class Scheduling System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 2, 2023Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules.CVE-2023-26430 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.5
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 1, 2023In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackeCVE-2023-33563 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 1, 2023A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL.CVE-2023-4053 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 31, 2023Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.CVE-2023-37772 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.
- Product
- Online Shopping Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpgurukul.comgithub.com
Jul 31, 2023A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute aCVE-2023-35861 · Other software · supermicro · reported by MITRECritical 9.8
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
- Product
- h12dst-b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.freax13.desupermicro.com
Jul 27, 2023Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.CVE-2022-31200 · Other software · Atmail · reported by MITREMedium 6.1
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.
- Product
- Atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comportswigger.net
Jul 27, 2023Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.CVE-2021-36580 · Other software · Icewarp · reported by MITREMedium 6.1
Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.
- Product
- Icewarp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.commail.ziyan.com
Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
- Product
- POST SMTP Mailer
- Fixed in
- 2.5.7
- What to do
- Update POST SMTP Mailer to 2.5.7 or newer.
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions.CVE-2023-27606 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2023Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controCVE-2023-37960 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.
- Product
- Jenkins MathWorks Polyspace Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 12, 2023POST SMTP Mailer: Cross-Site Request ForgeryCVE-2021-4422 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- POST SMTP Mailer
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update POST SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 12, 2023WP Reroute Email: Stored Cross-Site ScriptingCVE-2023-3168 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Reroute Email
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update WP Reroute Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023Mail Queue: Stored Cross-Site ScriptingCVE-2023-3167 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mail Queue
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Mail Queue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023Lana Email Logger: Stored Cross-Site ScriptingCVE-2023-3166 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Lana Email Logger
- Affected
- up to Lana
- What to do
- Affects up to Lana. Update Lana Email Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023Mail Control: Stored Cross-Site ScriptingCVE-2023-3158 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mail Control
- Affected
- up to 0.2.8
- What to do
- Affects up to 0.2.8. Update Mail Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023Mailtree Log Mail: Stored Cross-Site ScriptingCVE-2023-3135 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mailtree Log Mail
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Mailtree Log Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023GD Mail Queue: Stored Cross-Site ScriptingCVE-2023-3122 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GD Mail Queue
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update GD Mail Queue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023SMTP Mail: Stored Cross-Site ScriptingCVE-2023-3092 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SMTP Mail
- Affected
- up to 1.3.46
- What to do
- Affects up to 1.3.46. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023WP Mail Log: Stored Cross-Site ScriptingCVE-2023-3088 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Mail Log
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP Mail Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023WP Mail Logging: Stored Cross-Site ScriptingCVE-2023-3081 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.
- Product
- WP Mail Logging
- Affected
- up to 1.11.1
- What to do
- Affects up to 1.11.1. Update WP Mail Logging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023WP Mail Catcher: Stored Cross-Site ScriptingCVE-2023-3080 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Mail Catcher
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versioCVE-2023-34029 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 5, 2023A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.CVE-2023-37207 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Jul 3, 2023In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial CVE-2023-36053 · Other software · debian · reported by MITREHigh 7.5
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
- Product
- debian_linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 28, 2023Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.CVE-2023-32610 · Other software · SYNCK GRAPHICA · reported by vultures@jpcert.or.jpHigh 7.5
Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.
- Product
- Mailform Pro CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, forCVE-2023-20120 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Web Security Appliance (WSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jun 28, 2023A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security ManagCVE-2023-20119 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Secure Email and Web Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jun 28, 2023Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, forCVE-2023-20028 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Web Security Appliance (WSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jun 27, 2023Subscribe2: Unauthorized access to email functionalityCVE-2023-1844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.
- Product
- Subscribe2
- Affected
- up to 10.40
- What to do
- Affects up to 10.40. Update Subscribe2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2023The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling aCVE-2023-36632 · Other software · Python · reported by MITREHigh 7.5
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.python.orgdocs.python.org
Jun 22, 2023Grafana is validating Azure AD accounts based on the email claim.CVE-2023-3128 · Other software · Grafana · reported by security@grafana.comCritical 9.4
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.