Threats tagged 'ghsa-4ffj-9jv6-m8p5'

bbs-go versions through 4.4.6 have an improper certificate validation vulnerability in the sendEmail() function, which sets InsecureSkipVerify to true. This flaw allows network-positioned attackers to intercept SMTP traffic by presenting any certificate, enabling them to capture SMTP PLAIN authentication credentials and potentially read or modify outgoing password-reset and verification emails.