CVE-2018-7704
published 2018-03-15CVE-2018-7704: SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to…
PriorityP343medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EXPLOIT
EPSS
4.88%
91.0th percentile
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| securenvoy | securmail | < 9.2.501 | 9.2.501 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h4xx-3pm3-m447: SecurEnvoy SecurMail before 9
ghsa_unreviewed·2022-05-14
CVE-2018-7704 [MEDIUM] CWE-200 GHSA-h4xx-3pm3-m447: SecurEnvoy SecurMail before 9
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe.
Red Hat
ntp: Interleaved symmetric mode cannot recover from bad state
vendor_redhat·2018-02-27·CVSS 7.5
CVE-2018-7184 [HIGH] ntp: Interleaved symmetric mode cannot recover from bad state
ntp: Interleaved symmetric mode cannot recover from bad state
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
Package: ntp (Red Hat Enterprise Linux 5) - Not affected
Package: ntp (Red Hat Enterprise Linux 6) - Not affected
Package: ntp (Red Hat Enterprise Linux 7) - Not affected
Package: ntp (Red Hat Enterprise Linux 8) - Fix deferred
No detection rules found.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2018/Mar/29https://www.exploit-db.com/exploits/44285/https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.htmlhttp://seclists.org/fulldisclosure/2018/Mar/29https://www.exploit-db.com/exploits/44285/https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
2018-03-15
Published