505 matches found
CVE-2020-11880
An issue was discovered in KDE KMail before 19.12.3. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an...
CVE-2020-11879: Undefined Security Weakness
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as...
CVE-2020-11880: Undefined Security Weakness
An issue was discovered in KDE KMail before 19.12.3. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an...
PT-2020-12913 · Gnome +2 · Gnome Evolution +2
Name of the Vulnerable Software and Affected Versions: GNOME Evolution versions prior to 3.35.91 Description: An issue was discovered where a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to the...
Threat Analysis Unit (TAU) Threat Intelligence Notification: MailTo (NetWalker) Ransomware
MailTo is a ransomware variant that has recently been reported to have been part of a targeted attack against Toll Group, an Australian freight and logistics company. This ransomware makes no attempt to remain stealthy, and quickly encrypts the user’s data as soon as the ransomware is launched...
ACSC Releases Advisory on Mailto Ransomware Incidents
The Australian Cyber Security Centre ACSC has released an advisory on Mailto ransomware incidents. The ACSC has limited information regarding the initial intrusion vector for Mailto, also known as Kazakavkovkiz, but evidence suggests that Mailto actors may have used phishing and password spray...
Microsoft Outlook VCF cards - Denial of Service (PoC)
Exploit Title: Microsoft Outlook VCF cards - Denial of Service PoC Date: 2020-01-04 Exploit Author: hyp3rlinx Vendor Homepage: www.microsoft.com + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...
Microsoft Outlook VCF cards - Denial of Service (PoC)
Microsoft Outlook VCF cards - Denial of Service PoC Exploit Title: Microsoft Outlook VCF cards - Denial of Service PoC Date: 2020-01-04 Exploit Author: hyp3rlinx Vendor Homepage: www.microsoft.com + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...
Microsoft Windows VCF Denial Of Service Exploit
Microsoft Windows VCF cards do not properly sanitize email addresses allowing for HTML injection. A corrupt VCF card can cause all the users currently opened files and applications to be closed and their session to be terminated without requiring any accompanying attacker supplied code. + Credits...
Microsoft Windows VCF Denial Of Service
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-MAILTO-LINK-DENIAL-OF-SERVICE.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.microsoft.com Product A VCF file is a standard file format for...
Joomla Mailto 1.2.2.2 SQL Injection
Exploit Title : Joomla Mailto Components 1.2.2.2 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : hr-it-solutions.com Software Download Link : github.com/eddieajau/joomla-mailto...
Microsoft Windows .CONTACT File / HTML Injection Mailto: Remote Code Execution Vulnerability
Microsoft Windows is a popular operating system. A remote code execution vulnerability exists in Microsoft Windows .CCT File / HTML Injection Mailto:. The vulnerability is caused due to the processing of a ".contact" file, but the "email address" field uses the expected email address value. This...
Microsoft Windows CONTACT - HTML Injection / Remote Code Execution Vulnerability
Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt Vendor www.microsoft.com Produ...
Microsoft Windows CONTACT - HTML Injection Remote Code Execution
Microsoft Windows CONTACT - HTML Injection Remote Code Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec ...
Arbitrary File Read
evolution is vulnerable to arbitrary file read attacks. The vulnerability exists as GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email...
The vulnerability of Google Chrome browser’s Blink rendering module allows a hacker to execute arbitrary commands.
The vulnerability of the Blink rendering module in Google Chrome browsers is related to errors in handling “mailto” links. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially crafted HTML page from a remote location...
CVE-2017-5078
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...
UBUNTU-CVE-2017-5078
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...
CVE-2017-5078: Undefined Security Weakness
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...
