Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,712 results · page 50 of 115
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Contact Form Email
- Affected
- up to 1.3.24
- What to do
- Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 17, 2021SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.CVE-2021-43977 · Other software · Smartertools · reported by MITREMedium 6.1
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.
- Product
- Smartermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlsmartertools.com
Nov 17, 2021SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.CVE-2021-32234 · Other software · Smartertools · reported by MITRECritical 9.8
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
- Product
- Smartermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlsmartertools.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Nov 17, 2021Email Log: Does not properly validateCVE-2021-24758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
- Product
- Email Log
- Fixed in
- 2.4.7
- What to do
- Update Email Log to 2.4.7 or newer.
Nov 16, 2021AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code executionCVE-2021-26331 · Other software · AMD · reported by psirt@amd.comHigh 7.8
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI.CVE-2021-43574 · Other software · Atmail · reported by MITREMedium 6.1
WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.atmail.commedium.com
Nov 12, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent.CVE-2021-34357 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.9
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later
- Product
- QmailAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password.CVE-2021-43332 · Other software · GNU · reported by MITREMedium 6.5
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netlists.debian.org
Nov 12, 2021In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.CVE-2021-43331 · Other software · GNU · reported by MITREMedium 6.1
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netlists.debian.org
Nov 9, 2021In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.CVE-2021-43197 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 5, 2021Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) WeightCVE-2021-39416 · Other software · Remoteclinic · reported by MITREMedium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comremoteclinic.io
Nov 4, 2021Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting fromCVE-2021-39909 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email wiCVE-2021-40128 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by sending a crafted HTTP request to the account activation page of Cisco Webex Meetings. A successful exploit could allow the attacker to send to any recipient an account activation email that contains a tampered activation link, which could direct the user to an attacker-controlled website.
- Product
- Cisco Webex Meetings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Nov 4, 2021A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the UmCVE-2021-40126 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error message on the dashboard that appears when a user attempts to modify their email address when the new address already exists in the system. An attacker could exploit this vulnerability by attempting to modify the user's email address. A successful exploit could allow the attacker to enumerate email addresses of users in the system.
- Product
- Cisco Umbrella Insights Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Nov 4, 2021A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2021-34741 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.
- Product
- Cisco Email Security Appliance (ESA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Nov 2, 2021Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where eCVE-2021-43270 · Other software · Datalust · reported by MITREHigh 7.5
Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended.
- Product
- Seq.app.emailplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2021Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an ImproperCVE-2021-41313 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render imaCVE-2021-39220 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Oct 21, 2021WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_paramCVE-2021-28975 · Other software · Wpmailster · reported by MITREMedium 6.1
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.
- Product
- WP Mailster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompass-security.comcompass-security.com
Oct 20, 2021GNU Mailman before 2.1.35 may allow remote Privilege Escalation.CVE-2021-42097 · Other software · GNU · reported by MITREHigh 8
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.launchpad.net
Oct 20, 2021GNU Mailman before 2.1.35 may allow remote Privilege Escalation.CVE-2021-42096 · Other software · GNU · reported by MITREMedium 4.3
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.launchpad.net
Oct 12, 2021The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change.CVE-2021-35214 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.8
The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.
- Product
- Pingdom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolarwinds.comsolarwinds.com
Oct 12, 2021An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryCVE-2021-42009 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
- Product
- Apache Traffic Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Oct 6, 2021A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote CVE-2021-1534 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
- Product
- Cisco Email Security Appliance (ESA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Oct 5, 2021The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addressesCVE-2021-22258 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read.CVE-2021-41581 · Other software · Openbsd · reported by MITREMedium 5.5
x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
- Product
- Libressl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function.CVE-2020-24327 · Other software · Discourse · reported by MITREMedium 5.3
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
- Product
- Ninja Forms
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 21, 2021Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-37420 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Sep 20, 2021Dada Mail is a web-based e-mail list management system.CVE-2021-41083 · Other software · justingit · reported by GitHubHigh 8
Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any mailing list password, as well as the Dada Mail Root Password - which could effectively shut out actual list owners of the mailing list and allow the bad actor complete and unfettered control of your mailing list. This vulnerability also affects profile logins. For this vulnerability to work, the target of the bad actor would need to be logged into the list control panel themselves. This CSRF vulnerability in Dada Mail affects all versions of Dada Mail v11.15.1 and below. Although we know of no known CSRF exploits that have happened in the wild, this vulnerability has been confirmed by our testing, and by a third party. Users are advised to update to version 11.16.0.
- Product
- dada-mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.CVE-2020-19915 · Other software · Wuzhicms · reported by MITREMedium 6.1
Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 16, 2021OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.CVE-2021-27340 · Other software · Os4ed · reported by MITREMedium 6.1
OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5.CVE-2021-40347 · Other software · Postorius Project · reported by MITREMedium 5.4
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.
- Product
- Postorius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggitlab.com
Sep 10, 2021GNU-Mailman Integration: Reflected Cross-Site ScriptingCVE-2021-38354 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
- Product
- GNU-Mailman Integration
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update GNU-Mailman Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021DJ EmailPublish: Reflected Cross-Site ScriptingCVE-2021-38329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
- Product
- DJ EmailPublish
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update DJ EmailPublish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021User Activation Email: Reflected Cross-Site ScriptingCVE-2021-38325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0.
- Product
- User Activation Email
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update User Activation Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 8, 2021SmarterTools SmarterMail 16.x before build 7866 has stored XSS.CVE-2021-40377 · Other software · Smartertools · reported by MITREMedium 5.4
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.
- Product
- Smartermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartertools.comsmartertools.com
Sep 7, 2021Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability inCVE-2021-39122 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Sep 6, 2021It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS.CVE-2021-36093 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
- Product
- Email Encoder – Protect Email Addresses
- Fixed in
- 2.1.2
- What to do
- Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Sep 1, 2021Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmaileCVE-2021-36043 · Websites & servers · Adobe · reported by AdobeHigh 8
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Aug 31, 2021Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.CVE-2021-35220 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.1
Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 30, 2021Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificationCVE-2021-34646 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
- Product
- Booster for WooCommerce
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 30, 2021Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.CVE-2021-39272 · Other software · Fetchmail · reported by MITREMedium 5.9
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.
- Product
- Fetchmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
Aug 25, 2021Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain aCVE-2021-22243 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021A S/MIME issue existed in the handling of encrypted email.CVE-2021-30998 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A S/MIME issue existed in the handling of encrypted email. This issue was addressed with improved selection of the encryption certificate. This issue is fixed in iOS 15.2 and iPadOS 15.2. A sender's email address may be leaked when sending an S/MIME encrypted email using a certificate with more than one email address.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021A S/MIME issue existed in the handling of encrypted email.CVE-2021-30997 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A S/MIME issue existed in the handling of encrypted email. This issue was addressed by not automatically loading some MIME parts. This issue is fixed in iOS 15.2 and iPadOS 15.2. An attacker may be able to recover plaintext contents of an S/MIME-encrypted e-mail.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.