Here's How eFail Attack Works Against PGP and S/MIME Encrypted Emails

With a heavy heart, security researchers have early released the details of a set of vulnerabilities discovered in email clients for two widely used email encryption standards—PGP and S/MIME—after someone leaked their paper on the Internet, which was actually scheduled for tomorrow. PGP and S/MIM...

OpenPGP, S/MIME Mail Client Vulnerabilities

The CERT Coordination Center CERT/CC has released information on email client vulnerabilities that can reveal plaintext versions of OpenPGP- and S/MIME-encrypted emails. A remote attacker could exploit these vulnerabilities to obtain sensitive information. NCCIC encourages users and administrator...

MS03-011: Flaw in the Microsoft VM could enable system compromise

The Microsoft virtual machine Microsoft VM update that was previously listed in this article is no longer available. For more information, visit the following Microsoft Web pages: http://www.microsoft.com/mscorp/java/default.mspxhttp://support.microsoft.com/gp/lifean12Technical UpdateJuly 17, 200...

ASP.NET Core Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when a Kestrel web application fails to validate web requests. An attacker who successfully exploited this vulnerability could perform HTML injection attacks. To exploit the vulnerability, an attacker could send a specially crafted request, containin...

Hupa Cross-Site Scripting Vulnerability

Hupa is an email client written in GWT Google Web Toolkit that is primarily used to read, send and manage email. A cross-site scripting vulnerability exists in Hupa. A remote attacker could exploit this vulnerability by sending a specially crafted email to execute code...

The vulnerability in the implementation of the CSP mechanism in Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows attackers to perform cross-site scripting attacks.

The vulnerability of the Content Security Policy mechanism implemented in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the lack of measures taken to protect the structure of web pages using the sandbox directive. Exploiting this vulnerability allows a remote attack...

Zimbra Collaboration Suite Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com CVE ID : CVE-2017-8802 Product: Zimbra Collaboration Suite ZCS 1 Vendor: Synacor Inc. 2 Subject: Stored Cross-Site Scripting XSS Vulnerability Risk: High Effect: Exploitable by Anonymous Internet Adversaries Triggered in the Context of an...

Inmarsat AmosConnect8 Mail Client Vulnerable to SQL Injection and Backdoor Account

Overview Inmarsat Solutions offers a shipboard email client service, AmosConnect 8 AC8, which was designed to be utilized over satellite networks in a highly optimized manner. IOActive has identified two security vulnerabilities in the client software: On-board ship network access could provide...

Pegasus 4.72 Build 572 Remote Code Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PEGASUS-MAILTO-LINK-REMOTE-CODE-EXECUTION.txt + ISR: APPARITIONSEC Vendor: ============= www.pmail.com Product: ===================== Pegasus "winpm-32.exe" v4.72 build 572...

Pegasus winpm-32.exe v4.72 Mailto: Link Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PEGASUS-MAILTO-LINK-REMOTE-CODE-EXECUTION.txt + ISR: APPARITIONSEC Vendor: ============= www.pmail.com Product:...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to open a...

[SECURITY] Fedora 23 Update: roundcubemail-1.2.3-1.fc23

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

21CN Email Client - Micro Mail Android Version XSS Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. XSS vulnerability exists in the Android version of 21CN Email Client - MicroMail, which allows attackers to insert malicious js code into the page to obtain user cookies and other...

21CN Email Client - Micro Mail IOS Version XSS Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. XSS vulnerability exists in the IOS version of 21CN Email Client - MicroMail, which allows attackers to insert malicious js code into the page to obtain user cookies and other information,...

Airmail 3.0.2 - Cross-Site Scripting

Airmail is a popular email client on iOS and OS X. I found a vulnerability in airmail of the latest version which could cause a file:// xss and arbitrary file read. Author: redrain, [email protected] Date: 2016-08-15 Version: 3.0.2 and earlier Platform: OS X and iOS Site: http://airmailapp.com/...

Cygnus eMail Client - Email Content Cross-Site Scripting Vulnerability

Cygnus EaseMail Client is a professional e-mail client software for sending, receiving and managing e-mails, supporting the import of certificates and encrypted sending. A cross-site scripting vulnerability exists in the Cygnus Ease Mail client. It allows attackers to insert malicious js code int...

Design Vulnerability in YoMail Email Client of Shanghai Wulong Information Technology Co.

yomail is a lightweight design email client. A design vulnerability exists in the YoMail email client of Shanghai Wuji Information Technology Co. Ltd, which allows an attacker to execute js code, etc. by sending a payload...

[SECURITY] Fedora 23 Update: roundcubemail-1.1.5-1.fc23

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the nsNPObjWrapper::GetNewOrUsed function located in dom/plugins/base/nsJSNPRuntime.cpp in the Thunderbird email client, as well as in Firefox and Firefox ESR browsers, is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to execut...

The vulnerability of Firefox ESR, the rendering software Graphite 2, and the Thunderbird email client, which allows a hacker to trigger a service failure or obtain confidential information.

The vulnerability of the TtfUtil:LocaLookup function in the Firefox ESR browser, the Graphite 2 rendering software, and the Thunderbird email client is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to obtain confidential information ...