File Attachment persistent XSS

There is a persistent XSS vulnerability in the attachment download functionality of Confluence. By uploading a malicious executable file type like SVG scalable vector graphics with embedded JavaScript, it’s possible for an attacker to execute arbitrary code under the context of the logged in user...

Threat Outbreak Alert: Fake Delta E-Ticket Attachment Email Messages on March 29, 2016.

Medium Alert ID: 27100 First Published: 2012 October 3 15:13 GMT Last Updated: 2016 March 29 19:23 GMT Version: 44 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an e-ticket notification for the recipient. The text in the email messag...

Threat Outbreak Alert: Fake Invoice Statement Attachment Email Messages on April 15, 2014

Medium Alert ID: 27077 First Published: 2012 October 1 21:39 GMT Last Updated: 2014 April 16 11:23 GMT Version: 78 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an invoice statement for the recipient. The text in the email message...

Accidental XSRF and DoS consumption-of-space issue

We experienced an unusual growth of our nonspaced attachments that appears to be a DoS vunerability both in an accidental way with a workaround and intentional not easily worked around. This is under Confluence 4.0, but appears to probably apply to 4.3.1 as well. It appears the growing nonspaced...

CVE-2012-3731

Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors...

Out-of-bounds

The iCalendar component in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted date-time string in a .ics attachment...

Vulnerabilities in SumatraPDF Reader Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of multiple vulnerabilities affecting SumatraPDF Reader software version 2.0.1 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor...

Memory Corruption in Google SketchUp Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Google SketchUp software version 8.0.11752.0 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor,...

WordPress TDO Mini Forms Arbitrary File Upload

Exploit Title: Wordpress "TDO Mini Forms" File Upload Vulnerability Google Dork: "tdomf-upload-inline.php?tdomfformid=1 index" Date: 31/9/12 Exploit Author: HodLuM Vendor Homepage: unknown Software Link: http://thedeadone.net/download/tdo-mini-forms-wordpress-plugin/ Version: All Tested on: 2.x.x...

CVE-2009-5130

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

Code injection

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

CVE-2009-5130

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

Malware Campaign Targeting BlackBerry

Websense ThreatSeeker Network intercepted a malware campaign targeting BlackBerry customers. These fake emails state that the recipient has successfully created a BlackBerry ID. According to Security Labs, those users who are targeted receive an email with the subject line "Your BlackBerry ID has...

CVE-2012-4337

Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references...

Cross site scripting

Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references...

Spear Phishing Emails, Malware, Targeting BlackBerry Users

Blackberry owners are being targeted by a new type of malware that’s beginning to spread via spear phishing emails, according to security firm Websense. According to a post on the company’s blog, Security Labs, those users who are targeted receive an email with the subject line “Your BlackBerry I...

CVE-2012-4337

Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references...

Bugzilla < 3.6.10 / 4.0.7 / 4.2.2 / 4.3.2 Multiple Information Disclosures

According to its banner, the version of Bugzilla installed on the remote host is affected by multiple information disclosure vulnerabilities : - In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachment...

Safari Content-Disposition Handling Could Allow Cross-site Scripting

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple Safari software version 5.1.5 7534.55.3 for Windows and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affecte...

Threat Outbreak Alert: Fake Money Transfer Notification Email Messages on April 7, 2014

Medium Alert ID: 26690 First Published: 2012 August 20 19:55 GMT Last Updated: 2014 April 8 13:28 GMT Version: 78 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a copy of a money transfer receipt for the recipient. The email message...