6721 matches found
MoinMoin Directory Traversal vulnerability
Directory traversal vulnerability in the doattachmentmove function in the AttachFile action action/AttachFile.py in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. dot dot in a file name...
GHSA-5F2P-6VJV-2Q2M Sup Code Injection vulnerability
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment...
Sup Code Injection vulnerability
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment...
GHSA-HH2X-7MF9-78FR Sup Code Injection vulnerability
lib/sup/messagechunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the contenttype of an email attachment...
HTML attachments in phishing e-mails
The use of embedded HTML documents in phishing e-mails is a standard technique employed by cybercriminals. It does away with the need to put links in the e-mail body, which antispam engines and e-mail antiviruses usually detect with ease. HTML offers more possibilities than e-mail for camouflagin...
[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
Improper Input Validation in Apache CXF
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...
GHSA-7VGJ-8MW4-HG8R Improper Input Validation in Apache CXF
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...
Ursnif Malware Banks on News Events for Phishing Attacks
Ursnif aka Gozi, Dreambot, ISFB is one of the most widespread banking trojans. It has been observed evolving over the past few years. Ursnif has shown incredible theft capabilities. In 2020 Ursnif rose to prominence becoming one of the top ten most prolific pieces of malware. Among its core...
UBUNTU-CVE-2022-1520
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A...
MGASA-2022-0163 Updated thunderbird packages fix security vulnerability
Incorrect security status shown after viewing an attached email. CVE-2022-1520 Fullscreen notification bypass using popups. CVE-2022-29914 Bypassing permission prompt in nested browsing contexts. CVE-2022-29909 Leaking browser history with CSS variables. CVE-2022-29916 iframe sandbox bypass...
Design/Logic Flaw
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
Mozilla: Incorrect security status shown after viewing an attached email
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and...
Mozilla: Incorrect security status shown after viewing an attached email
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and...
CVE-2022-1464
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
Trac missing Content-Disposition HTTP header
Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors...
Emotet fixes bug in code, resumes spam campaign
Emotet threat actors resumed their email spam campaign on Monday after stopping it late last week to fix a bug. The bug—a flaw in how Emotet is installed onto a system after a victim opens a malicious email attachment—forced the actors to prematurely halt their campaign. Sample email of an Emotet...
Tripetto < 5.2.0 - Unauthenticated Stored Cross-Site Scripting
The plugin does not validate uploaded attachment files, which could allow unauthenticated users to upload malicious SVG and lead to Cross-Site Scripting...
The vulnerability of the vlc_input_attachment_New component in the VLC Media Player software allows a hacker to gain access to confidential data and also cause a service failure.
The vulnerability of the vlcinputattachmentNew component in the VLC Media Player software is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to gain access to confidential data and also cause a service failure by using a speciall...