Sebastian Schinzel

O problema está relacionado à falha do Fetchmail em aplicar a criptografia de sessão STARTTLS em determinadas circunstâncias, como com IMAP e PREAUTH.

Existia uma falha no S/MIME no tratamento de e-mails criptografados, permitindo que um invasor pudesse recuperar o conteúdo em texto simples de um e-mail criptografado por S/MIME. Essa falha foi corrigida com a exclusão do carregamento automático de algumas partes MIME.

A vulnerabilidade está relacionada ao recurso STARTTLS do Exim, que permite a injeção de respostas durante o envio SMTP pelo MTA. Isso se deve à neutralização insuficiente de elementos especiais na solicitação. A exploração dessa vulnerabilidade pode permitir que um invasor remoto comprometa a integridade dos dados.

O problema está relacionado a erros no gerenciamento de privilégios dentro do componente Plataforma HTML do Windows do sistema operacional Windows. Isso pode permitir que um invasor remoto contorne as restrições de segurança existentes.

As implementações do mecanismo de transporte de chaves PKCS#1 v1.5 para XMLEncryption no software afetado são suscetíveis a um ataque Bleichenbacher, que é um tipo de ataque de texto cifrado escolhido. Essa vulnerabilidade permite que um invasor recupere a chave simétrica e realize novos ataques. O problema está relacionado ao uso de um protocolo de criptografia simétrica fraco.

An issue existed in the handling of links in encrypted PDFs, which could allow an attacker to exfiltrate the contents of an encrypted PDF. This issue was addressed by adding a confirmation prompt.

The issue allows information disclosure on the backend.

The issue allows remote attackers to inject arbitrary web script or HTML via the admin panel, which is a result of a Cross-site Scripting (XSS) flaw.

The issue allows remote attackers to inject arbitrary web script or HTML via the `browse links` wizard, which is a type of Cross-site Scripting (XSS) attack. This occurs when an attacker sends malicious input to the application, which is then executed by the user's browser, potentially leading to unauthorized actions or data theft.

The issue allows remote attackers to inject arbitrary web script or HTML via the system extension recycler, which can lead to Cross-site Scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message, which can lead to Cross-site Scripting (XSS) attacks.

The issue allows information disclosure in the backend.

The issue allows remote attackers to extract arbitrary information from the TYPO3 database.

The issue allows remote attackers to delete arbitrary files on the web server.

The issue allows remote attackers to inject arbitrary web script or HTML. This is due to a Cross-site Scripting (XSS) flaw in the RemoveXSS function.

The issue allows remote attackers to retrieve ExtDirect endpoint services due to improper access control on ExtDirect calls.

The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) functionality in the Thunderbird email client, specifically concerning the lack of protection for certain data. This could allow a remote attacker to gain unauthorized access to protected information. Additionally, it is noted that encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in an HTML reply or forward.

The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) function in the Thunderbird email client, which lacks protection for certain data. This can allow a remote attacker to gain unauthorized access to protected information when an email is forwarded or replied to. Specifically, decrypted S/MIME parts that are hidden using CSS or the plaintext HTML tag can leak plaintext when included in an HTML reply or forward.

The issue is related to the decryption of S/MIME parts in HTML messages, which can lead to plaintext leakage when included in a reply or forward. This is due to a lack of protection for certain data in the S/MIME and PGP functions of the Thunderbird email client. An attacker can exploit this issue by manipulating HTML messages to gain unauthorized access to protected information.

The issue involves the Mail component and allows remote attackers to read the cleartext content of S/MIME encrypted messages via direct exfiltration.