IBM Domino KeyView PDF Filter Heap Buffer Overflow Vulnerability

IBM Domino formerly known as IBM Lotus Domino is a set of platforms for hosting social business applications from IBM in the United States. The platform combines business messaging, applications and social collaboration, and provides users with real-time online communication capabilities. A heap...

APT Group Sends Spear Phishing Emails to Indian Government Officials

Introduction On May 18, 2016, FireEye Labs observed a suspected Pakistan-based APT group sending spear phishing emails to Indian government officials. This threat actor has been active for several years and conducting suspected intelligence collection operations against South Asian political and...

Threat Outbreak Alert RuleID23103: Email Messages Distributing Malicious Software on May 26, 2016

Medium Alert ID: 46392 First Published: 2016 May 26 16:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23103 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID23124: Email Messages Distributing Malicious Software on May 26, 2016

Medium Alert ID: 46410 First Published: 2016 May 26 15:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23124 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID22941: Email Messages Distributing Malicious Software on May 18, 2016

Medium Alert ID: 46268 First Published: 2016 May 18 14:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22941 may contain the following files: Name | Size...

Automattic: WordPress core stored XSS via attachment file name

I think there's a problem with missing HTML encoding of attachment file names. A user with the capability to create attachments could compromise other accounts including administrator by injecting HTML tags in the file name. Creating attachment with arbitrary filenames is possible at least via th...

Threat Outbreak Alert RuleID22881: Email Messages Distributing Malicious Software on May 15, 2016

Medium Alert ID: 46189 First Published: 2016 May 16 14:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22881 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID22264: Email Messages Distributing Malicious Software on May 9, 2016

Medium Alert ID: 45090 First Published: 2016 May 9 14:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22264 may contain the following files: Name | Size ...

Design/Logic Flaw

The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and...

McAfee Email Gateway 7.6.x < 7.6.404 Blocked Email Alert XSS (SB10153)

The version of McAfee Email Gateway MEG installed on the remote host is 7.6.x prior to 7.6.404. It is, therefore, affected by a cross-site scripting XSS vulnerability that is triggered when File Filtering is enabled with the action set to 'ESERVICES:REPLACE'. This is due to a failure to validate...

Mail.ru: XSS с помощью специально сформированного файла.

XSS on sandbox domain via e-mail attachment...

RoundCube Webmail Cross-Site Request Forgery Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site request forgery vulnerability exists in RoundCube Webmail, which can be exploited by an attacker to download message attachments by sending a GET request with the download parameter set to 1...

users without "delete attachment permission" can delete attachment

go to space tools permissions and remove the permission of user X to delete attachments go to a page of that space which contains an attachment go to attachments no "delete" link available / expand an attachment to see older versionns including current version for each version there is the...

users without "delete attachment permission" can delete attachment

go to space tools permissions and remove the permission of user X to delete attachments go to a page of that space which contains an attachment go to attachments no "delete" link available / expand an attachment to see older versionns including current version for each version there is the...

PT-2016-5836

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.1.5 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that download attachments, potentially causing a denial of service due to disk...

Threat Outbreak Alert RuleID22404: Email Messages Distributing Malicious Software on April 21, 2016

Medium Alert ID: 44770 First Published: 2016 April 21 19:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22404 may contain the following files: Name | Si...

Threat Outbreak Alert RuleID22211: Email Messages Distributing Malicious Software on April 13, 2016

Medium Alert ID: 44632 First Published: 2016 April 13 14:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22211 may contain the following files: Name | Si...

HackerOne: Previous attachments can be referenced when creating a new report

Hello When user upload file in comment to report, user can find file ID by two ways: 1. In preview mode - In response to POST method https://hackerone.com/attachments , answer will be something like this: -"id":84577,"name":"mytestfile.png","size":32397 where fileID = 84577 for example 2. If user...

CVE-2016-3969

Cross-site scripting XSS vulnerability in McAfee Email Gateway MEG 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email...

Suspicious Office File Mail Phishing Attempt

Certain exploits or ransomware can be downloaded using office file extensions as mail attachments . A remote attacker could exploit this vulnerability to entice unsuspecting users to execute arbitrary files...