CVE-2019-9557

Ability Mail Server 4.2.6 has Persistent Cross Site Scripting XSS via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe...

RSAC 2019: Malicious Emailed URLs See Triple-Digit Increase

SAN FRANCISCO: Business emails laced with malicious URLs in the message body have spiked by more than 125 percent in Q4 2018 in comparison with the quarter before. According to Mimecast’s latest Email Security Risk Assessment ESRA report, released at the RSA Conference 2019 in San Francisco this...

Protecting against the next wave of advanced threats targeting Office 365 – Trend Micro Cloud App Security 2018 detection results and customer examples

Since the release of “Trend Micro Cloud App Security 2017 Report” about a year ago, threats using email as the delivery vector have grown significantly. Business Email Compromise BEC scams have already caused USD $12.5 billion in global losses as of 2018 – a 136.4% increase from the $5.3 billion...

Bypassing Email Security Controls (P1: URL Scanning)

The post Bypassing Email Security Controls P1: URL Scanning appeared first on Rhino Security Labs...

Don’t Blame Employees who fall for a BEC scam!

The BBC reports that a media company based in Scotland is now suing a former employee who fell for a Business Email Compromise BEC scam. In the scam, the employee received emails which appeared to be from the managing director and requested wire transfers. The employee worked with her line manage...

CVE-2018-15588

CVE-2018-15588 affects MailMate prior to 1.11.3, which mishandles a suspicious HTML/MIME structure in a signed/encrypted email. CVSSv3.0 base score 7.5 (High) with high integrity impact, network attack vector, low complexity, no privileges required.

CVE-2019-7628

Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...

CVE-2019-7628

Pagure 5.2 leaks API keys by emailing them to users due to a TLS-trusting CS mail path and insecure API token expiration reminder cron job in files/api_key_expire_mail.py. The issue enables MITM reading of emails and potential account compromise, with the root cause identified as the API key expi...

Security Bulletin: Content Collector for Email is affected by 3RD PARTY IBM WebSphere Application Server Deserialization

Summary Content Collector for Email has addressed the following vulnerability. IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. Vulnerability Details CVEID:...

Cisco Email Security Appliance Multiple DoS Vulnerabilities (cisco-sa-20190109-esa-dos / cisco-sa-20190109-esa-url-dos)

According to its self-reported version, the Cisco Email Security Appliance ESA is affected by the following vulnerabilities: - A denial of service DoS vulnerability exists in Secure/Multipurpose Internet Mail Extensions S/MIME Decryption and Verification and S/MIME Public Key Harvesting features...

CVE-2015-9279

CVE-2015-9279 affects MailEnable prior to version 8.60. The issue is a Stored XSS via malformed HTML in email bodies where a tag like "" character, enabling script execution. Affected component is MailEnable’s mail server rendering/processing of email content (stored XSS). Impact described in sou...

Cisco Email Security Appliance Email Message Filtering Denial of Service Vulnerability

The Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system used in it. A security vulnerability exists in the email message filtering functionality in the Cisco AsyncOS Software of the Cisco ESA, which stems from the...

Cisco Email Security Appliance S/MIME Denial of Service Vulnerability

The Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system used in it. A security vulnerability exists in the Secure/Multipurpose Internet Mail Extensions S/MIME Decryption and Verification or S/MIME Public Key Harvesting...

CVE-2018-15460

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service DoS condition on an affected device. The...

CVE-2018-15460

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service DoS condition on an affected device. The...

CVE-2018-15460 Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service DoS condition on an affected device. The...

CVE-2018-15460 Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service DoS condition on an affected device. The...

CVE-2018-15460

CVE-2018-15460 affects Cisco AsyncOS Software for Cisco Email Security Appliances (ESA). The flaw is in the email message filtering feature, caused by improper filtering of messages that reference whitelisted URLs. An unauthenticated, remote attacker can send a malicious email containing a large ...

Design/Logic Flaw

A vulnerability in the Secure/Multipurpose Internet Mail Extensions S/MIME Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause an affected device to corrupt...

CVE-2018-15453

A vulnerability in the Secure/Multipurpose Internet Mail Extensions S/MIME Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause an affected device to corrupt...