CVE-2020-36519

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs...

Spoofing

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs...

CVE-2020-36519

CVE-2020-36519 (Mimecast Email Security) : The vulnerability, affecting Mimecast Email Security prior to 2020-01-10, allows any administrator to spoof any domain and bypass DMARC alignment via SPF by abusing the address rewrite feature. The spoofed domain must be a customer in the Mimecast grid f...

CVE-2020-36519

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs...

Mimecast Email Security 安全漏洞

Mimecast Email Security is Mimecast's appliance for email security. A security vulnerability exists in Mimecast Email Security that allows any administrator to spoof any domain and pass DMARC alignment via SPF. This occurs through abuse of the address rewriting feature. The spoofed domain must be...

F-Secure 多款产品安全漏洞

F-Secure Elements Agent and others are products of F-Secure Finland.F-Secure Elements Agent is a cloud-native endpoint protection system.F-Secure MDR is a managed network security service.F-Secure Client Security is a client security F-Secure Client Security is a client-side security solution. A...

Ukrainian CERT Warns Citizens of Phishing Attacks Using Compromised Accounts

Ukraine's Computer Emergency Response Team CERT-UA warned of new phishing attacks aimed at its citizens by leveraging compromised email accounts belonging to three different Indian entities with the goal of compromising their inboxes and stealing sensitive information. The agency cautioned that t...

Fortinet FortiMail Input Validation Error Vulnerability

Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. The product provides email security protection and data protection, among other features.An input validation error vulnerability exists in the FortiMail Web server CGI facility. An unauthenticated attacker could...

Cyberattackers Leverage DocuSign to Steal Microsoft Outlook Logins

A sophisticated phishing campaign directed at a “major, publicly traded integrated payments solution company located in North America” made use of DocuSign and a compromised third party’s email domain to skate past email security measures, researchers said. The campaign spread seemingly innocuous...

Cybonet PineApp Mail Secure SQL注入漏洞

Cybonet PineApp Mail Secure is Cybonet Israel's solution for blocking most malicious email threats at the network perimeter, while providing a range of additional options for comprehensive security and messaging control.Cybonet PineApp Mail Relay is vulnerable to a SQL injection vulnerability tha...

Cybonet PineApp Mail Secure 安全漏洞

Cybonet PineApp Mail Secure is Israel's Cybonet's ability to block most malicious email threats at the network perimeter while providing a range of additional options for comprehensive security and message control. Cybonet PineApp Mail Secure Relay suffers from a security vulnerability that can b...

Horde Webmail 5.2.22 - Account Takeover via Email

Horde Webmail is a free, enterprise-ready, and browser-based communication suite developed by the Horde project. It is a popular webmail solution for universities and government agencies to exchange sensitive email messages on a daily basis. It is also shipped as part of the popular hosting...

The vulnerability of the email verification component (DANE) based on DNS in Cisco AsyncOS operating system for the Cisco Email Security Appliance allows a attacker to trigger a service failure.

The vulnerability of the email verification component DANE in Cisco AsyncOS operating systems for the Cisco Email Security Appliance is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

OAuth consent phishing, in the wild

TL;DR An interesting incident response investigation showed exploitation of a recent OAuth related consent-phishing issue. We had been asked to investigate as the organisation had noticed some odd behaviours in the mailbox of one of the exec team. The mailbox was being queried using GraphAPI and...

Watch out for this bump in LinkedIn phishing

LinkedIn is sometimes forgotten about in more general coverage of phishing attacks. Social media sites such as Facebook, Twitter, and Instagram receive regular attention. Cryptowallet customer support scams run wild in the replies to any cryptocurrency themed tweet. Facebook users can often be...

Attackers Can Crash Cisco Email Security Appliances by Sending Malicious Emails

Cisco has released security updates to contain three vulnerabilities affecting its products, including one high-severity flaw in its Email Security Appliance ESA that could result in a denial-of-service DoS condition on an affected device. The weakness, assigned the identifier CVE-2022-20653 CVSS...

Cisco Email Security Appliance Resource Management Error Vulnerability (CNVD-2022-13368)

The Cisco Email Security Appliance ESA is an email security appliance from Cisco, U.S.A. A resource management error vulnerability exists in the Cisco Email Security Appliance DNS Verification, which could be exploited by an attacker to cause the appliance to be inaccessible from the management...

CVE-2022-20653

A vulnerability in the DNS-based Authentication of Named Entities DANE email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability...

CVE-2022-20653

A vulnerability in the DNS-based Authentication of Named Entities DANE email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability...

Design/Logic Flaw

A vulnerability in the DNS-based Authentication of Named Entities DANE email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability...