Vulnerabilities

TI-2019-06614 CVE-2019-9150 · GHSA-mhxr-j555-xm46

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown…

LOW 27

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01379 Published 2019-07-09 No fix listed CWE-320

TI-2019-06613 CVE-2019-9149 · GHSA-hjgw-9xvw-334r

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its…

LOW 31

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0089 Published 2019-07-09 No fix listed CWE-347

TI-2019-06612 CVE-2019-9148 · GHSA-7jh7-fp3w-72g5

Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope…

LOW 23

Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01388 Published 2019-07-09 No fix listed CWE-295

TI-2019-06611 CVE-2019-9147 · GHSA-592g-jmww-649w

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings…

LOW 23

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01441 Published 2019-07-09 No fix listed CWE-1021

Vulnerabilities

Filters

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown…

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its…

Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope…

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings…