Docebo LMS <= 4.0.4 - (messages) Remote Code Execution

No description provided by source. ?php / Docebo LMS = v4.0.4 messages remote code execution exploit vendor: http://www.docebo.com/ software link: http://www.docebo.com/community/doceboCms/ author: mrme::rwx kru email: steventhomasseeley!gmail!com We must become the change we want to see in the...

Qualcomm Eudora 5.2.1/6.0 File Attachment Spoofing Variant Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7653/info Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing malicious conten...

Qualcomm Eudora 5.1 Hidden Attachment Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2796/info Eudora is an email program for the Windows platform. Eudora contains a vulnerability which may make it possible for an attacker to excecute arbitrary code on a remote system even if 'allow executables in HTML...

BTD Studio Zom-Mail 1.0.9 - Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/761/info In certain versions of the BTD Zom-Mail server there exists a buffer overflow which may be remotely exploitable by malicious users. The problem in question is in the handling of overly past 256 chars long file...

MDaemon 8.0 Content Filter Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14400/info MDaemon server is prone to a directory traversal vulnerability due to improper sanitization of user input. Failure to sanitize the filename and path may result in compromise of the file system outside of the...

Wordpress Mini Mail Dashboard Widget Plugin 1.36 Remote File Inclusion

No description provided by source. Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Seemingly malformed PNG file will cause JIRA to OOM within seconds

.atlassian.net was chain-OOM-ing earlier today. jworley was able to narrow it down to an image attachment on a particular issue. It's only a 300KB PNG file a screenshot from an Android device but it causes JIRA to OOM almost immediately. I've been able to replicate that behaviour on my jira-dev...

Threat Outbreak Alert RuleID10429: Email Messages Distributing Malicious Software on September 15, 2014

Medium Alert ID: 34697 First Published: 2014 June 24 18:09 GMT Last Updated: 2014 September 17 15:09 GMT Version: 4 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID10429 a...

FangMail又一处储存型XSS

简要描述： 又一处 详细说明： 附件文件名处未过滤，可触发XSS 假设攻击者为[email protected]，受害者为[email protected] import smtplib import base64 sender = '[email protected]' reciever = '[email protected]' message = """From: To: Subject: Test MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="YOUAREUNDERATTACK"...

Coremail 邮件系统存储型 XSS

简要描述： 设计疏忽导致可执行恶意 JavaScript 代码。 详细说明： 我原以为和 WooYun: Coremail邮件系统存储型XSS之二 这里是同一种文件漏洞，问过之后，了解到不是同一个。 本漏洞是直接预览 SVG 图片附件，会触发 SVG 内部脚本。新版本 Coremail “除了部分格式的图片和PDF”，不知道有没有修复这个问题，姑且发出来吧。 如图，用户预览附件即会触发 XSS。 （不嫌麻烦的话可以配合之前获取 sid/mid 的漏洞，在正文内插入链接、跳转到附件 SVG 的预览地址，作为伪装。） 漏洞证明：...

Discuz跨域数据劫持＋附件类型限制绕过

简要描述： 两个凑一块发了 详细说明： 1 跨域数据劫持（csrf token formhash盗取） 下载远程附件功能不会对文件内容（文件格式）进行检测导致可以上传恶意的swf文件（扩展名还是图片扩展名），进而进行跨域数据劫持： 伪造图片CrossDomainDataHijack.jpg相关代码： package com.powerflasher.SampleApp import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import...

openSUSE Security Update : roundcubemail (openSUSE-SU-2014:0365-1)

roundcubemail was updated to 0.9.5 to fix bugs and security issues. Fixed security issues : - CVE-2013-6172: vulnerability in handling session argument of utils/save-prefs New upstream release 0.9.5 bnc847179 CVE-2013-6172 - Fix failing vCard import when email address field contains spaces - Fix...

openSUSE Security Update : flash-player (openSUSE-SU-2011:0215-1)

The Adobe Flash Player was updated to the 10.2.153.1, fixing several bugs and one security issue. This vulnerability CVE-2011-0609 could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild...

Please make sure you have offline backups

This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering...

Threat Outbreak Alert: Fake Product Purchase Order Request Email Messages on May 30, 2014

Medium Alert ID: 34429 First Published: 2014 May 30 19:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a purchase order request for the recipient. The text in the email message attempts to convince the recipient to op...

Threat Outbreak Alert: Fake Credit Card Statement Email Messages on May 30, 2014

Medium Alert ID: 34428 First Published: 2014 May 30 18:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a credit card statement for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake Bank Statements Notification Email Messages on May 29, 2014

Medium Alert ID: 34416 First Published: 2014 May 29 18:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank statements for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Picture Sharing Email Messages on May 29, 2014

Medium Alert ID: 34412 First Published: 2014 May 29 18:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a picture for the recipient. The text in the email message attempts to convince the recipient to...

Threat Outbreak Alert: Email Messages with Malicious Attachments on May 28, 2014

Medium Alert ID: 34407 First Published: 2014 May 29 13:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain a malicious attachment for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Financial Assistance Request Email Messages on May 29, 2014

Medium Alert ID: 34410 First Published: 2014 May 29 13:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial assistance request details for the recipient. The text in the email message attempts to convince the...