3532 matches found
Nigerian phishing: Industrial companies under attack
In late 2016, the Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team Kaspersky Lab ICS CERT reported on phishing attacks that were primarily targeting industrial companies from the metallurgy, electric power, construction, engineering and other sectors. As further research...
Updated libytnef packages fix security vulnerabilities
Several issues were discovered in libytnef, a library used to decode application/ms-tnef e-mail attachments. Multiple heap overflows, out-of-bound writes and reads, NULL pointer dereferences and infinite loops could be exploited by tricking a user into opening a maliciously crafted winmail.dat fi...
Country micro CMS government website system list of attachments exist SQL injection vulnerability
No description provided by source...
[SECURITY] [DSA 3869-1] tnef security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3869-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-3869-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Stored XSS Cross-Site Scripting Vulnerability in Coremail Mail System of Intex
Coremail mail system is a large-scale enterprise mail system independently developed by the company. There is a stored XSS cross-site scripting vulnerability in the surplus world Coremail mail system, due to the fact that coremail does not effectively filter the content of attachments, which It...
CVE-2015-4704
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the File parameter to download.php...
Directory traversal
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the File parameter to download.php...
CVE-2015-4704
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the File parameter to download.php...
CVE-2015-4704
CVE-2015-4704 is a directory traversal vulnerability in the WordPress plugin Download Zip Attachments 1.0. It allows remote attackers to read arbitrary files by supplying a .. in the File parameter to download.php, due to insufficient input/path validation. Affected software: WordPress Download Z...
Trello: api flaw
Hope you guys are doing great. While going through your api documentation on https://developers.trello.com/advanced-reference/cardpost-1-cards-card-id-or-shortlink-actions-comments , an api endpoint POST /1/cards/card id or shortlink/attachments supposed to be rate-limited after 100 attachment bu...
Trello: XML entity expansion using svg file
Hope you guys are doing great. I want to report xml entity expansion bug while uploading svg file . When adding a card in boards it also allows to upload attachments which can include svg files. Users or admin can then download those attachment but the problem is when svg file is uploaded, websit...
Design/Logic Flaw
Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...
CVE-2017-8899
Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...
CVE-2017-8899
Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...
Debian DSA-3846-1 : libytnef - security update
Several issues were discovered in libytnef, a library used to decode application/ms-tnef e-mail attachments. Multiple heap overflows, out-of-bound writes and reads, NULL pointer dereferences and infinite loops could be exploited by tricking a user into opening a maliciously crafted winmail.dat...
PT-2017-2152 · Microsoft · Office
Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to the improper handling of data in Microsoft Office, which can be exploited by a remote attacker to execute arbitrary code. The exploitation can occur when a...
[SECURITY] Fedora 26 Update: tnef-1.4.14-2.fc26
This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...
Dridex and Locky Return Via PDF Attachments in Latest Campaigns
Dridex and Locky, two prolific malware families that made waves in 2016 after being distributed in several high-volume spam campaigns, have returned after a brief hiatus. FireEye observed a decline in the volume of Dridex and Locky in the latter half of 2016, but we recently observed two new larg...