Novell GroupWise WebAccess Cross-Site Scripting (CVE-2014-0611)

A cross-site scripting vulnerability exists in Novell GroupWise WebAccess. The vulnerability is due to lack of input validation when handling email attachments. A remote, unauthenticated attacker can exploit this vulnerability by enticing a target user to view crafted web content. A successful...

Click-Fraud Malware Spreading via JavaScript Attachments

A new malware campaign has been spotted that has begun seeding spam messages with a downloader heavily obfuscated with JavaScript. The SANS Internet Storm Center said today that two days ago, a flood of spam messages were observed laced with .js attachments. The JavaScript obfuscates a downloader...

Threat Outbreak Alert RuleID17014: Email Messages Distributing Malicious Software on July 28, 2015

Medium Alert ID: 40192 First Published: 2015 July 28 18:07 GMT Last Updated: 2015 July 29 10:58 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17014 and...

CVE-2015-5379: Axigen XSS vulnerability for html attachments

CVEID: CVE-2015-5379 SUBJECT: Axigen XSS vulnerability for html attachments DESCRIPTION: Axigen's WebMail Ajax interface implements a view attachment function that executes javascript code that is part of email HTML attachments. This allows a malicious user to craft email messages that could expo...

WordPress GD bbPress Attachments 2.1 Cross Site Scripting / Local File Inclusion Vulnerabilities

WordPress GD bbPress Attachments plugin version 2.1 suffers from a cross site scripting and Local File Inclusion Vulnerabilities Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report:...

WordPress GD bbPress Attachments 2.1 Local File Inclusion

Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report: https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/ CV...

WordPress GD bbPress Attachments 2.1 Cross Site Scripting

Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report: https://security.dxw.com/advisories/reflected-xss-in-gd-bbpress-attachments-allows-an-attacker-to-do-almost-anything-an-admin-can/ CVE: Awaiting...

WordPress GD bbPress Attachments Plugin <= 2.2 - XSS

This vulnerability is in forms/panels.php. It allows an attacker to inject arbitrary web script or HTML via the "tab" parameter that is in the gdbbpressattachments page to wp-admin/edit.php. Solution Update the plugin...

WordPress GD bbPress Attachments Plugin <= 2.2 - Directory Traversal

This vulnerability allows a remote administrator to include and execute arbitrary local files in the "tab" parameter in the gdbbpressattachments page to wp-admin/edit.php. Solution Update the plugin...

WordPress Download Zip Attachments 'download.php' Plugin Arbitrary File Download Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in the WordPress Download Zip Attachments 'download.php' plugin due to the program failing to adequately filter...

Threat Outbreak Alert RuleID16419: Email Messages Distributing Malicious Software on July 22, 2015

Medium Alert ID: 39654 First Published: 2015 July 6 13:01 GMT Last Updated: 2015 July 23 12:37 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16419 and...

Download Zip Attachments 1.0 File Download

Title: Remote file download vulnerability in download-zip-attachments v1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-10 Download Site: https://wordpress.org/plugins/download-zip-attachments/ Vendor: rivenvirus Vendor Notified: 2015-06-15 Vendor Contact:...

WordPress Zip Attachments Plugin Arbitrary File Download Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in the WordPress Zip Attachments plugin, which allows remote attackers to exploit the vulnerability by submitting a...

WordPress Zip Attachments Plugin <= 1.5.0 - Directory Traversal

This vulnerability allows an attacker to read arbitrary files in the "zafile" parameter. Solution Update the plugin...

Zip Attachments <= 1.1.4 - Arbitrary File Download

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file. http://www.example.com/wp-content/plugins/zip-attachments/download.php?zafile=../../../../../etc/passwd&zafilename=passwd...

Zip Attachments <= 1.1.4 - Arbitrary File Download

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file. PoC http://www.example.com/wp-content/plugins/zip-attachments/download.php?zafile=../../../../../etc/passwdfilename=passwd...

Download Zip Attachments <= 1.0 - Arbitrary File Download

The download-zip-attachments WordPress plugin was affected by an Arbitrary File Download security vulnerability...

Phishers Going the Long Way Round to Avoid Filtering Systems

Any human with an email address likely has gotten thousands of spam messages that look like delivery notifications, invoices, or other alleged communications from shipping companies such as UPS or DHL. They typically contain malicious attachments with exploits for a browser or plug-in...

Udemy: xss profile

some fields in the profile are vulnerable for static cross site scriptings. see attachments...

Nepal Earthquake Disaster Email Scams

US-CERT warns users of potential email scams citing the earthquake in Nepal. The scam emails may contain links or attachments that may direct users to phishing or malware infected websites. Phishing emails and websites requesting donations for fraudulent charitable organizations commonly appear...