Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,712 results · page 67 of 115
Mar 8, 2018A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to coCVE-2018-0208 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CSCvg74126.
- Product
- Email Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 4, 2018Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.CVE-2018-7662 · Other software · Couchcms · reported by MITREMedium 5.3
Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
- Product
- Couch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2018A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disCVE-2017-14461 · Other software · The Dovecot Project · reported by talos-cna@cisco.comMedium 5.9
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlists.debian.org
Feb 27, 2018Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project.CVE-2012-3536 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.
- Product
- Apache Hupa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsvn.apache.orgjames.apache.org
Feb 21, 2018A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail RelayCVE-2018-0203 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted requests to the targeted application. A successful exploit could allow the attacker to send email messages to arbitrary addresses. Cisco Bug IDs: CSCvg62215.
- Product
- Unity Connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 8, 2018MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2018-0514 · Websites & servers · futomi Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
- Product
- MP Form Mail CGI eCommerce Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2018A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote atCVE-2018-0140 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.
- Product
- Email Security Appliance Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 7, 2018In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can bCVE-2018-6823 · Other software · Mailbutler · reported by MITRECritical 9.8
In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.
- Product
- Shimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.CVE-2017-6199 · Other software · Sandstorm · reported by MITRECritical 9.8
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.
- Product
- Sandstorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6291 · Other software · Kaspersky Labs · reported by vulnerability@kaspersky.comMedium 6.1
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.
- Product
- Kaspersky Secure Mail Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comcoresecurity.com
Feb 6, 2018Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6290 · Other software · Kaspersky Labs · reported by vulnerability@kaspersky.comHigh 7.8
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.
- Product
- Kaspersky Secure Mail Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comcoresecurity.com
Feb 6, 2018Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6289 · Other software · Kaspersky Labs · reported by vulnerability@kaspersky.comCritical 9.8
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.
- Product
- Kaspersky Secure Mail Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comcoresecurity.com
Feb 6, 2018Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6288 · Other software · Kaspersky Labs · reported by vulnerability@kaspersky.comHigh 8.8
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.
- Product
- Kaspersky Secure Mail Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comcoresecurity.com
Feb 3, 2018webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remoteCVE-2018-6596 · Other software · Django-anymail Project · reported by MITRECritical 9.1
webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
- Product
- Django-anymail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Feb 2, 2018The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-18039 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.
- Product
- Jira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjira.atlassian.com
Jan 31, 2018The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.CVE-2018-6465 · WordPress plugins & themes · reported by MITREMedium 6.1
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
- Product
- PropertyHive
- Fixed in
- 1.4.15
- What to do
- Update PropertyHive to 1.4.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jan 31, 2018In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a fCVE-2017-8916 · Other software · Cisecurity · reported by MITREHigh 7.8
In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.
- Product
- Cis-cat Pro Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisecurity.orgcisecurity.org
Jan 26, 2018An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.CVE-2018-6015 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
- Product
- An issue was discovered in the "Email Subscribers & Newsletters
- Fixed in
- 3.4.8
- What to do
- Update An issue was discovered in the "Email Subscribers & Newsletters to 3.4.8 or newer.
Full record and what to do →NVD recordblog.threatpress.comwordpress.org
Jan 23, 2018Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-optionCVE-2018-5950 · Other software · GNU · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jan 21, 2018index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address paraCVE-2018-5962 · Other software · Control-webpanel · reported by MITREMedium 6.1
index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.
- Product
- Webpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Jan 21, 2018JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (segfCVE-2017-18045 · Other software · Directadmin · reported by MITRECritical 9.8
JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (segfault) via an unspecified request.
- Product
- Directadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddirectadmin.comdirectadmin.com
Jan 19, 2018The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafteCVE-2015-6926 · Other software · Oxid-esales · reported by MITREHigh 7.5
The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.
- Product
- Eshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.oxid-esales.comoxidforge.org
Jan 18, 2018A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) could allowCVE-2018-0095 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a privilege level of a guest user. The vulnerability is due to an incorrect networking configuration at the administrative shell CLI. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a set of crafted, malicious commands at the administrative shell. An exploit could allow the attacker to gain root access on the device. Cisco Bug IDs: CSCvb34303, CSCvb35726.
- Product
- Asyncos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 14, 2018Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/cCVE-2018-5700 · Other software · Magicwinmail · reported by MITREHigh 8.8
Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/class.ftpfolder.php) to move a .php file from the FTP folder into a web folder.
- Product
- Winmail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2018The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.CVE-2018-5693 · Computers, phones & browsers · Linuxmagic · reported by MITRELow 3.3
The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.
- Product
- Magicspam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.wizard.cavulnerability-lab.com
Jan 12, 2018Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) CVE-2017-17970 · Other software · Muvikoscript · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) season_id parameter to themes/flixer/ajax/load_season.php; the (3) movie_id parameter to themes/flixer/ajax/get_rating.php; the (4) rating or (5) movie_id parameter to themes/flixer/ajax/update_rating.php; or the (6) id parameter to themes/flixer/ajax/set_player_source.php.
- Product
- Muviko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 12, 2018The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-siteCVE-2017-16862 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.
- Product
- Jira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjira.atlassian.com
Jan 10, 2018A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled CVE-2017-17946 · Other software · Novosoft · reported by MITRECritical 9.8
A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action.
- Product
- Handy Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsidechannel.tempestsi.com
Jan 9, 2018Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, sucCVE-2018-0819 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 6.5
Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, such as phishing, due to how Outlook for Mac displays encoded email addresses, aka "Spoofing Vulnerability in Microsoft Office for Mac."
- Product
- Microsoft Office 2016 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 9, 2018Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email messages are parsed, CVE-2018-0793 · Email & office · Microsoft Corporation · reported by secure@microsoft.comHigh 7.8
Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0791.
- Product
- Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 3, 2018Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesysCVE-2017-1000485 · Other software · Nylas Mail Lives Project · reported by MITREHigh 7.8
Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations.
- Product
- Nylas Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email addressCVE-2017-1000489 · Other software · Acquia · reported by MITREHigh 8.1
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2017Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APCVE-2016-10704 · Websites & servers · Magento · reported by MITREMedium 6.1
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
- Product
- Magento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Dec 29, 2017The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authenCVE-2013-7400 · Other software · DKD · reported by MITREHigh 7.5
The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comextensions.typo3.org
Dec 27, 2017The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.CVE-2015-7889 · Computers, phones & browsers · Google · reported by MITREMedium 5.5
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 27, 2017Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitraCVE-2017-16768 · Network & remote access · Synology · reported by security@synology.comMedium 4.8
Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter.
- Product
- Mailplus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9.CVE-2017-17848 · Other software · Enigmail · reported by MITREHigh 7.5
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9.CVE-2017-17847 · Other software · Enigmail · reported by MITREHigh 7.5
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenigmail.netlists.debian.org
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9.CVE-2017-17846 · Other software · Enigmail · reported by MITREHigh 7.5
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenigmail.netlists.debian.org
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9.CVE-2017-17845 · Other software · Enigmail · reported by MITREHigh 7.3
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenigmail.netlists.debian.org
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9.CVE-2017-17844 · Other software · Enigmail · reported by MITREMedium 6.5
An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenigmail.netlists.debian.org
Dec 27, 2017An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regularCVE-2017-17843 · Other software · Enigmail · reported by MITREMedium 5.9
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
- Product
- Enigmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenigmail.netlists.debian.org
Dec 21, 2017Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.CVE-2017-17828 · Other software · Doditsolutions · reported by MITREMedium 4.8
Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.
- Product
- Busbooking-script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_reaCVE-2017-17752 · Other software · Codecrafters · reported by MITREMedium 6.1
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
- Product
- Ability Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 18, 2017SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter.CVE-2017-15875 · Other software · Sistemagpweb · reported by MITRECritical 9.8
SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter.
- Product
- Gpweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaugustopereira.com.braugustopereira.com.br
Dec 15, 2017The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.CVE-2017-14093 · Other software · Trend Micro · reported by security@trendmicro.comMedium 6.1
The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.
- Product
- Trend Micro ScanMail for Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comcoresecurity.com
Dec 15, 2017The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an aCVE-2017-14092 · Other software · Trendmicro · reported by security@trendmicro.comHigh 8.8
The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
- Product
- Scanmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comcoresecurity.com
Dec 15, 2017A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources CVE-2017-14091 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.5
A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory.
- Product
- Trend Micro ScanMail for Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comcoresecurity.com
Dec 15, 2017A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.CVE-2017-14090 · Other software · Trend Micro · reported by security@trendmicro.comCritical 9.1
A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.
- Product
- Trend Micro ScanMail for Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comcoresecurity.com
Dec 15, 2017A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attacker to execute arbiCVE-2017-11397 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.
- Product
- Trend Micro Encryption for Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comsuccess.trendmicro.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.