Forcepoint Email Security 安全漏洞

Forcepoint Email Security is a suite of email protection solutions from US-based Forcepoint. The product includes features such as spam filtering, malware detection, phishing protection, and protection against intrusion BEC attacks. A security vulnerability exists in Forcepoint Email Security...

Cisco Ironport Bruteforce Login Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Ironport Bruteforce Login Utility', 'Description' = % This module scans for Cisco Ironport SMA, WSA and ESA web login portals, finds AsyncO...

GHSA-V333-7H2P-5FHV ZITADEL has improper HTML sanitization in emails and Console UI

Impact ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker,...

ZITADEL has improper HTML sanitization in emails and Console UI

Impact ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker,...

How To Get the Most From Your Security Team's Email Alert Budget

We'll TL;DR the FUDdy introduction: we all know that phishing attacks are on the rise in scale and complexity, that AI is enabling more sophisticated attacks that evade traditional defenses, and the never-ending cybersecurity talent gap means we're all struggling to keep security teams fully...

Cybonet 信息泄露漏洞

Cybonet is an enterprise email security system from Cybonet Israel. Cybonet suffers from an information disclosure vulnerability that originates from the disclosure of sensitive information to unauthorized actors...

Smule: Possible Subdomain Takeover For Inbound Emails

The affected URL email.smule.com pointed to sendgrid.net via a DNS CNAME record. As a result, a subdomain takeover was possible by registering the subdomain email.smule.com on Sendgrid...

Openfind Information Technology MailAudit Operating System Command Injection Vulnerability

Openfind Information Technology MailAudit is a software for enterprise email security auditing from Openfind Information Technology Taiwan, China. An operating system command injection vulnerability exists in Openfind Information Technology MailAudit, which originates from an inability to properl...

U.S. Dept Of Defense: Subdomain takeover ██████

The subdomain █████ was found to be pointing to open-elb-prod-277276106.us-east-1.elb-amazonaws.com., and the domain elb-amazonaws.com was available for registration. This vulnerability could have been exploited to host unwanted content, receive email, and potentially execute cross-site scripting...

PT-2024-4062

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions prior to the fixed version Description: A critical zero-click remote code execution vulnerability has been discovered in Microsoft Outlook. This vulnerability allows attackers to execute arbitrary code by sending a...

ZendFramework potential remote code execution in zend-mail via Sendmail adapter

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they c...

From trust to trickery: Brand impersonation over the email attack vector

Cisco recently developed and released a new feature to detect brand impersonation in emails when adversaries pretend to be a legitimate corporation. Talos has discovered a wide range of techniques threat actors use to embed and deliver brand logos via emails to their victims. Talos is providing n...

HSC Cybersecurity HC Mailinspector 安全漏洞

HSC Cybersecurity HC Mailinspector is a cloud email security solution from HSC Cybersecurity. A security vulnerability exists in HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18, which stems from a vulnerability that allows a regular user account to escalate its privileges and...

CVE-2024-34471

An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability resulting in file deletion exists in the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality does not properly validate the file location, allowing an attacker to read and delete...

Cisco Enterprise Chat and Email 安全漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from the American company Cisco. The product provides email, chat, and web callback functionality for other Cisco solutions. A security vulnerability exists in Cisco Enterprise Chat and Email that stems from the...

CVE-2024-2727

CVE-2024-2727 is described as an HTML injection vulnerability in the CIGESv2 system (Stored XSS). The connected documents confirm the affected product (CIGESv2) and vulnerability class, noting ability to inject arbitrary code and modify website and email confirmation content. No concrete details ...

Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks

Threat actors are leveraging digital document publishing DDP sites hosted on platforms like FlipSnack, Issuu, Marq, Publuu, RelayTo, and Simplebooklet for carrying out phishing, credential harvesting, and session token theft, once again underscoring how threat actors are repurposing legitimate...

CVE-2024-22398

An improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system...

Path traversal

An improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system...

CVE-2024-22398

The CVE-2024-22398 entry describes a Path Traversal vulnerability in SonicWall Email Security Appliance. An attacker with administrative privileges can perform a directory traversal to delete arbitrary files from the appliance file system. Root cause: improper limitation of a pathname to a restri...