Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,712 results · page 58 of 115
Feb 12, 2020scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.CVE-2013-7378 · Other software · Hubot Scripts Project · reported by MITRECritical 9.8
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
- Product
- Hubot Scripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 10, 2020The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext.CVE-2019-20061 · Other software · Mfscripts · reported by MITREHigh 7.5
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.commfscripts.com
Feb 8, 2020The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users'CVE-2012-5570 · Other software · Basic Webmail Project · reported by Red HatMedium 4.3
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
- Product
- Basic Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 6, 2020Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or CVE-2012-2593 · Other software · Atmail · reported by cret@cert.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
- Product
- Atmail Webmail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Feb 4, 2020Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.CVE-2019-15610 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
- Product
- Circles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Feb 4, 2020Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.CVE-2011-4912 · Websites & servers · Joomla! · reported by Red HatMedium 5.3
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgopenwall.com
Feb 3, 2020Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.CVE-2020-7993 · Other software · Prototypejs · reported by MITREMedium 4.3
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Product
- Prototype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2020Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php.CVE-2013-2623 · Other software · Telaen Project · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php.
- Product
- Telaen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 31, 2020In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.CVE-2020-8512 · Other software · Icewarp · reported by MITREMedium 6.1
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
- Product
- Icewarp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Jan 27, 2020CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to injeCVE-2015-3154 · Other software · Zend Technologies · reported by Red HatMedium 6.1
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
- Product
- Zend Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordframework.zend.comframework.zend.com
Jan 26, 2020A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2020-3134 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. This vulnerability affects Cisco AsyncOS Software for Cisco ESA releases earlier than 13.0.
- Product
- Cisco Email Security Appliance (ESA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jan 24, 2020A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing CVE-2019-1460 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
- Product
- Microsoft Outlook for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jan 24, 2020A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed loCVE-2019-3693 · Other software · SUSE · reported by meissner@suse.deHigh 7.7
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
- Product
- SUSE Linux Enterprise Server 11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 23, 2020An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they shCVE-2019-15712 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.2
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.
- Product
- Fortimail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jan 23, 2020An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup confCVE-2019-15707 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.9
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.
- Product
- Fortimail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jan 22, 2020The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, CVE-2018-16271 · Computers, phones & browsers · Samsung · reported by MITREMedium 6.5
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
- Product
- Galaxy Gear Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedia.defcon.orgyoutube.com
Jan 15, 2020A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.CVE-2009-5025 · Other software · PyForum · reported by Red HatHigh 7.5
A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.
- Product
- PyForum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 15, 2020A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attackerCVE-2019-15961 · Other software · ClamAV · reported by psirt@cisco.comHigh 7.5
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.clamav.netlists.debian.org
Jan 15, 2020Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display).CVE-2020-2672 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Email Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display).CVE-2020-2671 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Email Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display).CVE-2020-2670 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Email Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display).CVE-2020-2669 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Email Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to CVE-2020-2094 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.
- Product
- Jenkins Health Advisor by CloudBees Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content toCVE-2020-2093 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.
- Product
- Jenkins Health Advisor by CloudBees Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.CVE-2014-7844 · Other software · BSD · reported by Red HatHigh 7.8
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
- Product
- mailx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinux.oracle.comrhn.redhat.com
Jan 9, 2020The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailinCVE-2012-2724 · Other software · Simplenews · reported by Red HatMedium 5.3
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
- Product
- Simplenews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2020There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parCVE-2019-20361 · WordPress plugins & themes · reported by MITRECritical 9.8
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).
- Fixed in
- 4.3.1
- What to do
- Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jan 7, 2020HMailServer 5.3.x and prior: Memory Corruption which could cause DOSCVE-2013-5571 · Other software · Hmailserver · reported by MITREMedium 5.9
HMailServer 5.3.x and prior: Memory Corruption which could cause DOS
- Product
- Hmailserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuriteam.comsecuriteam.com
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.CVE-2019-19265 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgredteam-pentesting.de
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.CVE-2019-19266 · Other software · Icewarp · reported by MITREMedium 5.4
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgredteam-pentesting.de
Jan 2, 2020The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an emailCVE-2019-20203 · WordPress plugins & themes · reported by MITREMedium 5.3
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
- Product
- Postie
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compostieplugin.com
Dec 31, 2019An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2.CVE-2019-10229 · Other software · Mailstore · reported by MITREHigh 8.8
An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login attempt.
- Product
- Mailstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.mailstore.comhelp.mailstore.com
Dec 30, 2019_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the accounCVE-2019-19806 · Other software · Mfscripts · reported by MITREMedium 5.3
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2019_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address isCVE-2019-19805 · Other software · Mfscripts · reported by MITREMedium 5.3
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.CVE-2019-19985 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and emaiCVE-2019-19984 · WordPress plugins & themes · reported by MITREMedium 6.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.CVE-2019-19982 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.CVE-2019-19981 · WordPress plugins & themes · reported by MITREMedium 5.4
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) CVE-2019-19980 · WordPress plugins & themes · reported by MITREMedium 4.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp_ajax function to send_test_email.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 23, 2019A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution.CVE-2019-7489 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
- Product
- Email Security Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Dec 23, 2019Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database.CVE-2019-7488 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
- Product
- Email Security Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Dec 22, 2019In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbcCVE-2019-11049 · Websites & servers · PHP Group · reported by security@php.netMedium 6.5
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.php.netlists.fedoraproject.org
Dec 18, 2019A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 aCVE-2019-19829 · Other software · Solarwinds · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182.
- Product
- Serv-u FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 17, 2019MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.CVE-2019-19497 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
- Product
- Mdaemon Email Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2019NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailsCVE-2019-19315 · Other software · Nalpeiron · reported by MITREHigh 7.1
NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailslot mailslot.
- Product
- Licensing Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2019The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromCVE-2019-17123 · Other software · Egain · reported by MITREHigh 7.5
The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2019In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer DerCVE-2019-19722 · Other software · Dovecot · reported by MITREMedium 5.3
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdovecot.org
Dec 5, 2019Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g.CVE-2019-18180 · Other software · Otrs · reported by MITREMedium 5.3
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
- Product
- Otrs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Nov 28, 2019A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitraryCVE-2019-19386 · Other software · Fusionpbx · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemail_id parameter.
- Product
- Fusionpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 26, 2019An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature.CVE-2019-18453 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.