CVE-2016-6462

A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass Advanced Malware Protection AMP filters that are configured for an affected device. This vulnerability affects all releases...

TrickBot Banking Trojan Adds New Browser Manipulation Tools

The TrickBot banking Trojan, a close relative to Dyre, has a growing target list and new browser manipulation techniques, experts at IBM X-Force said. “We expect to see it amplify infection campaigns and fraud attacks, sharpen its aim on business and corporate accounts,” wrote Limor Kessem,...

Nymaim Dropper Updates Delivery, Obfuscation Methods

A new variant of the Nymaim dropper has been identified that includes updated delivery and obfuscation methods, and the use of PowerShell routines to download its payloads. The updated dropper, used primarily to download banking Trojans in the past, has also been spreading ransomware, according t...

Microsoft revealed there have been hacker using the Microsoft Edge vulnerability in the attack-vulnerability warning-the black bar safety net

Microsoft today to Windows 7, Windows 8.1, Windows 1 0 and Office to push a security update to fix vulnerabilities. These updates fixes the IE, Microsoft Edge, Office, Windows and Skype Business 4 9 security vulnerabilities. This 4 9 a security vulnerability 5 the vulnerability can be used to...

Android OSP Mail Arbitrary Attachment Read Vulnerability

Android is an open source operating system based on Linux. A security vulnerability in the email/provider/AttachmentProvider.java file in Android's AOSP Mail allows remote attackers to exploit the vulnerability to build malicious apps that can read the contents of attachments...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

Code injection

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

CVE-2016-3918

email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted applicatio...

Hancitor Downloader Abusing APIs, PowerShell Commands

Developers behind the malicious downloader Hancitor have bolstered the malware again, this time with new delivery approaches that make it more difficult to detect. The downloader is still spread through malicious attachments, and distributing malware designed to steal data, such as Pony and...

The vulnerability of the Microsoft Outlook email client, which allows a hacker to bypass virus or spam detection systems

The vulnerability of the Microsoft Outlook email client is related to the improper implementation of the requirements specified in RFC 2046. Exploiting this vulnerability allows a malicious actor to bypass virus or spam detection systems by using specially crafted MIME data in email attachments...

iSpy Keylogger Targets Passwords, Skype, Webcams

Researchers are monitoring sales and infection rates of a new keylogger being sold on the dark web for $25 to $35. Along with capturing keystrokes, iSpy grabs passwords stored in web browsers, records Skype chats, takes webcam screenshots and steals the license keys of software such as Adobe...

Bugs in Signal Messaging App Corrupt Attachments, Crash App

Makers of the mobile encrypted chat app Signal say they have fixed vulnerabilities in the Android version of the messaging app that allowed attackers to corrupt encrypted attachments and remotely crash the application. The vulnerabilities were discovered by Jean-Philippe Aumasson and Markus Vervi...

CVE-2016-3366

Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail attachment, aka "Microsoft Office...

Microsoft Office Spoofing Vulnerability

Microsoft Office is an office software suite of products developed by the U.S. company Microsoft Microsoft. Commonly used components are Word, Excel, Access, Powerpoint, FrontPage and so on. A spoofing vulnerability exists in Microsoft Office that stems from Microsoft Outlook's failure to strictl...

MS16-107: Description of the security update for Outlook 2016: September 13, 2016

None None...

MS16-108: Security update for Exchange Server: September 13, 2016

Resolves vulnerabilities in Exchange Server in which the most severe of the vulnerabilities could allow remote code execution in some Oracle Outside In Libraries that are built into Exchange Server. This issue might occur if an attacker sends an email message with a specially crafted attachment t...

[SECURITY] Fedora 24 Update: elog-3.1.1-7.fc24

ELOG is part of a family of applications known as weblogs. Their general purpose is: 1. To make it easy for people to put information online in a chronological fashion, in the form of short, time-stamped text messages "entries" with optional HTML markup for presentation, and optional file...

Harvest: XSS on expenses attachments

Summary ------ Hey there! After 152591 was fixed, I decided to take another look at the attachments and found a new bypass to upload attachments which will be served with a user-controlled Content-type. The invoices attachments are not vulnerable, as they are all served with Content-Disposition:...

Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Email Attachment

Summary Improper handling of email attachments by "OX Guard" causes a Stored Cross-Site Scripting XSS vulnerability inside the OX "Mail" module. Injected code will be executed when the victim opens the HTML attachment of a decrypted email by using the "Open in browser" link/button. Proof of Conce...