CVE-2017-9801

CVE-2017-9801 affects Apache Commons Email (versions 1.0–1.4). A call-site passing an email subject containing line-breaks can be exploited to inject arbitrary SMTP headers, due to a flaw in how setSubject handles input. This can lead to SMTP header manipulation and potential information exposure...

Adding Security to Your Managed Services Offering

Over the years Trend Micro has collaborated with and learned from a variety of MSPs. Today’s threat landscape is continuously evolving, becoming more complex and sophisticated than it was even a year ago. For MSPs to rely on a single solution is not practical or in the best interest of their...

Mercure - A Tool For Security Managers Who Want To Train Their Colleague To Phishing

Mercure is a tool for security managers who want to teach their colleagues about phishing. What Mercure can do: Create email templates Create target lists Create landing pages Handle attachments Let you keep track in the Campaign dashboard Track email reads, landing page visits and attachment...

Threat Outbreak Alert RuleID29926: Email Messages Distributing Malicious Software on August 2, 2017

Medium Alert ID: 54724 First Published: 2017 August 3 19:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29926 may contain the following files: Name | Si...

SMTP Header Injection

Apache Commons Email is vulnerable to SMTP Header Injections. A malicious user can inject arbitrary SMTP Headers by passing line-breaks as a subject of an email...

email.powweb.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-272038 Description| Value ---|--- Affected Website:| email.powweb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Threat Outbreak Alert RuleID30029: Email Messages Distributing Malicious Software on July 31, 2017

Medium Alert ID: 54632 First Published: 2017 July 31 15:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30029 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID30005: Email Messages Distributing Malicious Software on July 28, 2017

Medium Alert ID: 54616 First Published: 2017 July 28 13:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30005 may contain the following files: Name | Siz...

CVE-2017-11617

CVE-2017-11617 describes a Cross-site Scripting (XSS) vulnerability in atmail prior to version 7.8.0.2. An attacker can inject arbitrary web script or HTML into the body of an email by manipulating an IMG element that contains both single and double quotes, enabling remote code execution in the c...

Threat Outbreak Alert RuleID29898: Email Messages Distributing Malicious Software on July 24, 2017

Medium Alert ID: 54565 First Published: 2017 July 24 15:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29898 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29860: Email Messages Distributing Malicious Software on July 18, 2017

Medium Alert ID: 54517 First Published: 2017 July 18 16:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29860 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29818: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54501 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29818 may contain the following files: Name | Siz...

Cisco AsyncOS for Email Security Appliance Attachment MIME Header Handling Filter Bypass (cisco-sa-20170607-esa1)

According to its self-reported version, the Cisco AsyncOS running on the remote Cisco Email Security ESA appliance is affected by a security bypass vulnerability in the email message scanning functionality due to improper validation of emails with attachments and a modified Multipurpose Internet...

WakaTime: Lack of Password Confirmation When Changing Email

When any user wants to change the password, current password is asked for proceeding the request. This should also be implemented on changing the email. Attack Scenerio : When some forget to logout from the account in a publc computer, anyone can change the email to its own and verify it. And aft...

WakaTime: Add arbitrary content to Password Reset Email

Hi, I noticed the inclusion of IP Address in the email sent for password reset. Then I tried including a new header, X-Forwarded-For to see if the IP Address in the email could change. Though it didn't change it but it did include whatever value that was injected in the header. Request POST...

Threat Outbreak Alert RuleID29629: Email Messages Distributing Malicious Software on June 29, 2017

Medium Alert ID: 54329 First Published: 2017 June 29 18:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29629 may contain the following files: Name | Siz...

CVE-2017-6324

Summary of CVE-2017-6324 (Symantec Messaging Gateway) : A security feature bypass vulnerability exists in SMG when handling a specific Word attachment with macros, allowing bypass of the administrator-enabled disarm functionality. This is documented by multiple sources (NVD entry and vendor/Nessu...

UK Parliament Hit by Cyberattack, Up to 90 MPs' E-mail Accounts Hacked

A cyber attack has hit the email system of UK Houses of Parliament on Friday morning that breached at least 90 emails accounts protected by weak passwords belonging to MPs, lawmakers, and other parliamentary staff. Meanwhile, as a precaution, the Security service has temporarily shut down the...

Threat Outbreak Alert RuleID29511: Email Messages Distributing Malicious Software on June 19, 2017

Medium Alert ID: 54228 First Published: 2017 June 19 13:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29511 may contain the following files: Name | Siz...

Cisco Email Security Appliance Attachment Filter Bypass Vulnerability

The Cisco Email Security Appliance is a suite of email security appliances.Cisco Content Security Management is a unified email and Web security management solution. An email scanning vulnerability exists in the Cisco AsyncOS Software in the Cisco Email Security Appliance ESA appliance that stems...