CVE Vulnerability Catalog

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters. This can lead to misinterpretation of message security status.

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email. This may undermine trust in encryption and message authenticity.

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK]. This can mislead recipients about message authenticity and integrity.

In SEPPmail Secure Email Gateway before version 15.0.3, an attacker can cause attacker-controlled certificates to be used for future encryption to a victim by adding those certificates to S/MIME signatures. As a result, future communication may be encrypted with the attacker's key.

In SEPPmail Secure Email Gateway before version 15.0.3, an attacker can hide security tags from users by crafting a long subject. This may mislead users about the security status of the message.

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates.

The a11y-mcp tool by priyankark versions up to 1.0.5 contains a Server-Side Request Forgery vulnerability in the A11yServer function in src/index.js. The attack must be initiated locally, and the exploit has been made public. The vendor notes it is a local stdio MCP server with no HTTP endpoint.

A security vulnerability was detected in itsourcecode Payroll Management System up to 1.0 in the file /navbar.php. Manipulating the page argument leads to cross-site scripting. The attack can be launched remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in Nothings stb up to 1.22, affecting the start_decoder function in stb_vorbis.c. The manipulation results in an out-of-bounds write. The exploit has been released to the public and may be used for remote attacks.

IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript in the Web UI, altering functionality and potentially leading to credential disclosure within a trusted session.

A vulnerability was identified in Nothings stb up to 1.22 in the setup_free function of stb_vorbis.c, leading to allocation of resources. The attack can be carried out remotely, and a publicly available exploit might be used. The vendor was contacted early but did not respond.

A vulnerability was found in the stb library (stb_truetype.h) up to version 1.26, in the stbtt__buf_get8 function handling TTF files. Manipulation can lead to an out-of-bounds read. The attack can be executed remotely and the exploit has been publicly disclosed.

HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas without proper authentication.

A vulnerability in the stb library (stb_truetype.h) up to version 1.26 causes an out-of-bounds read in stbtt_InitFont_internal when processing TTF files. The flaw can be exploited remotely and a public exploit exists.

IBM Aspera Shares versions 1.9.9 through 1.11.0 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM Aspera Shares versions 1.9.9 through 1.11.0 is vulnerable to HTTP header injection caused by improper validation of the HOST header. This could allow an attacker to conduct various attacks, including cross-site scripting, cache poisoning, or session hijacking.

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

In IBM Aspera Shares versions 1.9.9 through 1.11.0, sessions are not invalidated after a password reset, which could allow an authenticated user to impersonate another user on the system.

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

In the stb library (stb_image.h) up to version 2.30, the stbi__gif_load_next function in the GIF decoder component allows denial of service via crafted input. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.