Spearphishing Attack Spoofs Microsoft.com to Target 200M Office 365 Users

A spearphishing attack is spoofing Microsoft.com to target 200 million Microsoft Office 365 users in a number of key vertical markets, including financial services, healthcare, manufacturing and utility providers. Researchers at Ironscales discovered the campaign targeting several thousand...

MTN Group: PHP Info Exposing Secrets at https://radio.mtn.bj/info

Summary: During recon I discovered a PHP Info file exposing environment variables such as; Laravel APPKEY, Database username/password, SMTP username/password, etc. Steps To Reproduce: Visit the following URL; https://radio.mtn.bj/info You will be presented with a PHP Info file exposing environmen...

Vulnerability fixed in Thunderbird

When reading status codes from the SMTP server, Thunderbird an integer to a position on the stack that is is intended to contain only one byte. Depending on the processor architecture and the stack layout, this leads to corruption of the stack that could potentially be abused. Mozilla has release...

Black Friday 2020: How to shop safely online

Black Friday 2020 promises to be somewhat different from years gone by thanks to COVID-19. The annual surge of in-store chaos and trolley dashes isn’t compatible with social distancing, and so retailers will be looking to drive shoppers online. Friday 27th November is when things kick off this...

The vulnerability of the software’s zip-file decompression mechanism in Cisco AsyncOS affects Cisco Email Security Appliance security systems. This vulnerability allows attackers to bypass the configured content filters on the device.

The vulnerability of the software’s zip-file decompression mechanism for Cisco Email Security Appliance devices is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to bypass the configured content filters on the device...

CVE-2020-7769

CVE-2020-7769 affects the Node.js nodemailer package up to version 6.4.16. The vulnerability arises from improper input validation of recipient email addresses in the sendmail transport, allowing a crafted recipient address to inject arbitrary command flags. Documents indicate a high/severe impac...

Cisco Email Security Appliance Zip Content Filter Bypass Vulnerability

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected...

PT-2020-4621 · Cisco · Cisco Email Security Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Email Security Appliance affected versions not specified Description: The issue is related to the zip decompression engine of Cisco AsyncOS Software, which is used in Cisco Email Security Appliance. It is caused by improper handling of...

CVE-2020-15245

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that th...

The vulnerability of the command-line interface of the Cisco AsyncOS operating system allows a hacker to gain unauthorized access to protected information. This vulnerability is exploitable by attackers who target the Cisco Email Security Appliance for security management and the Cisco Content Security Management Appliance for content management systems.

The vulnerability of the Cisco AsyncOS command-line interface for the Cisco Email Security Appliance and the Cisco Content Security Management Appliance security management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker,...

Cisco Email Security Appliance URL Filter Bypass Vulnerability

Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. A URL filter bypass vulnerability exists in the Cisco AsyncOS anti-spam protection mechanism used by the Cisco Email Security Appliance. The...

Cisco Email Security Appliance URL Filtering Bypass (cisco-sa-esa-url-bypass-zZtugtg3)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by a URL filtering bypass vulnerability in Cisco AsyncOS Software. An unauthenticated, remote attacker can exploit this, by crafting a URL in a particular way, to bypass URL reputation filters and allow malicio...

CVE-2020-3568

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

Input validation

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

CVE-2020-3568 Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

CVE-2020-3568

Summary: CVE-2020-3568 affects Cisco Email Security Appliance (ESA) running Cisco AsyncOS. The issue is in the antispam/URL filtering path where insufficient input validation of URLs can allow an unauthenticated, remote attacker to bypass URL reputation filters by crafting a URL in a specific way...

CVE-2020-3568 Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

Feds Sound Alarm Over Emotet Attacks on State, Local Govs

A dramatic uptick in Emotet phishing attacks since July has led the U.S. Cybersecurity and Infrastructure Security Agency CISA to issue a warning that state and local governments need to fortify their systems against the trojan. “This increase has rendered Emotet one of the most prevalent ongoing...

Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

IRS COVID-19 Relief Payment Deadlines Anchor Convincing Phish

A credential-phishing email campaign is making the rounds, using the lure of coronavirus tax relief to scam people into giving up their personal information. The data-harvesting cybercriminals are looking to take advantage of the Internal Revenue Service IRS deadlines that are approaching for...