BASS Automated Signature Synthesizer: BASS

BASS Automated Signature Synthesizer BASS pronounced “bæs” is a framework designed to automatically generate antivirus signatures from samples belonging to previously generated malware clusters. It is meant to reduce resource usage of ClamAV by producing more pattern-based signatures as opposed t...

Artifex jbig2dec 'jbig2_image_compose' function integer overflow vulnerability

Artifex jbig2dec is an implementation for decoding JBIG2 streams in PDF files in Ghostscript and MuPDF. An integer overflow vulnerability exists in the 'jbig2imagecompose' function of the jbig2image.c file in Artifex jbig2dec version 0.13. An attacker can exploit this vulnerability with the help ...

DEBIAN-CVE-2017-7976

Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2imagecompose function in jbig2image.c during operations on a crafted .jb2 file, leading to a denial of service application crash or disclosure of sensitive information from process memory...

Lithium Forum - (Compose Message) SSRF Vulnerability

Document Title: =============== Lithium Forum - Compose Message SSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2030 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-ID: ==================================== 2030...

Fome SMS Portal 2.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Fome SMS Portal Advanced - Bulk SMS Reseller v2.0 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy:...

osquery Command And Control: Kolide

osquery Command And Control Kolide is an agentless osquery web interface and remote api server. Kolide uses the osquery remote apis to do ad-hoc distributed queries, osqueryd configurations and the collection and processing of scheduled queries packs. Kolide was designed to be extremely portable ...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information

The vulnerability in the mail/compose/ComposeActivity.java function of the AOSP Mail component in the Android operating system is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential informati...

Clair - Vulnerability Static Analysis for Containers

Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the compose function in the AOSP Mail component of the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential information through a specially creat...

CVE-2016-2458

The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and...

CVE-2016-2458

The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and...

CVE-2016-2458

The CVE-2016-2458 issue affects AOSP Mail: the compose functionality in Android 5.0.x (pre-5.0.2), 5.1.x (pre-5.1.1), and 6.x (pre-2016-05-01) does not adequately restrict attachments, enabling information disclosure via a crafted app related to ComposeActivity.java and ComposeActivityEmail.java....

Mail.ru: XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо

Здравствуйте! https://light.mail.ru/compose и https://m.mail.ru/composeid/reply подвержены второму вектору XSS похожему на 88492. Вторая уязвимость существует из-за недостаточной фильтрации текста сообщения, на которое хочет ответить пользователь, при его выводе в - поле ответа - в качестве цитат...

Fedora 19 : claws-mail-3.11.1-2.fc19 / claws-mail-plugins-3.11.1-1.fc19 / libetpan-1.6-1.fc19 (2014-14237) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

Fedora 20 : claws-mail-3.11.1-2.fc20 / claws-mail-plugins-3.11.1-1.fc20 / libetpan-1.6-1.fc20 (2014-14234) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

openSUSE Security Update : claws-mail (openSUSE-SU-2014:1384-1) (POODLE)

Claws Mail was updated to version 3.11.0. Changes : + SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability CVE-2014-3566. + Several PGP/Core plugin improvements : - Indicate when a key has been revoked or has expired when displaying signature status. - Whe...

How to use PGP encryption with Mozilla Thunderbird Email client

In my last article, we have learnt that how to encrypt our Emails using Gnu Privacy Guard. Previously we used Microsoft Outlook as a desktop mail client and a GpgOL plugin to handle encryption decryption of our communication. Since Microsoft is a US-based company, that has to follow all the laws ...

CVE-2013-5645

Multiple cross-site scripting XSS vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in 1 new or 2 draft mode, related to compose.inc; and 3 might allow remote authenticated users to injec...

Multiple browsers DoS

Mail program compose message window is created for avery frame with mailto:, news:, nntp:, etc URI...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSconfigdirplugins parameter to plugins/address/admin/index.php, 2 GLOBALSconfigdirfunctions parameter to plugins/im/compose.php, and 3...