Sebastian Schinzel

The issue is related to Fetchmail's failure to enforce STARTTLS session encryption under certain circumstances, such as with IMAP and PREAUTH.

A S/MIME issue existed in the handling of encrypted email, allowing an attacker to potentially recover plaintext contents of an S/MIME-encrypted email. This issue was addressed by not automatically loading some MIME parts.

The issue is related to the STARTTLS feature in Exim, which allows response injection during MTA SMTP sending. This is due to insufficient neutralization of special elements in the request. The exploitation of this issue may allow a remote attacker to impact data integrity.

The issue is related to errors in privilege management within the Windows HTML Platform component of the Windows operating system. This can allow a remote attacker to bypass existing security restrictions.

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in the affected software are susceptible to a Bleichenbacher attack, which is a type of chosen-ciphertext attack. This weakness allows an attacker to recover the symmetric key and conduct further attacks. The issue is related to the use of a weak symmetric encryption protocol.

An issue existed in the handling of links in encrypted PDFs, which could allow an attacker to exfiltrate the contents of an encrypted PDF. This issue was addressed by adding a confirmation prompt.

The issue allows information disclosure on the backend.

The issue allows remote attackers to inject arbitrary web script or HTML via the admin panel, which is a result of a Cross-site Scripting (XSS) flaw.

The issue allows remote attackers to inject arbitrary web script or HTML via the `browse links` wizard, which is a type of Cross-site Scripting (XSS) attack. This occurs when an attacker sends malicious input to the application, which is then executed by the user's browser, potentially leading to unauthorized actions or data theft.

The issue allows remote attackers to inject arbitrary web script or HTML via the system extension recycler, which can lead to Cross-site Scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message, which can lead to Cross-site Scripting (XSS) attacks.

The issue allows information disclosure in the backend.

The issue allows remote attackers to extract arbitrary information from the TYPO3 database.

The issue allows remote attackers to delete arbitrary files on the web server.

The issue allows remote attackers to inject arbitrary web script or HTML. This is due to a Cross-site Scripting (XSS) flaw in the RemoveXSS function.

The issue allows remote attackers to retrieve ExtDirect endpoint services due to improper access control on ExtDirect calls.

The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) functionality in the Thunderbird email client, specifically concerning the lack of protection for certain data. This could allow a remote attacker to gain unauthorized access to protected information. Additionally, it is noted that encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in an HTML reply or forward.

The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) function in the Thunderbird email client, which lacks protection for certain data. This can allow a remote attacker to gain unauthorized access to protected information when an email is forwarded or replied to. Specifically, decrypted S/MIME parts that are hidden using CSS or the plaintext HTML tag can leak plaintext when included in an HTML reply or forward.

The issue is related to the decryption of S/MIME parts in HTML messages, which can lead to plaintext leakage when included in a reply or forward. This is due to a lack of protection for certain data in the S/MIME and PGP functions of the Thunderbird email client. An attacker can exploit this issue by manipulating HTML messages to gain unauthorized access to protected information.

The issue involves the Mail component and allows remote attackers to read the cleartext content of S/MIME encrypted messages via direct exfiltration.