EFF Activists, Journalists Hit By Targeted Malware Attack

Phishing and malware attacks are among the more democratic and populist threats on the Internet. You don’t have to stand in the crowd in order to be targeted; the attackers will get to you sooner or later. But while most malware campaigns are aimed at the masses, attackers often save their best...

Microsoft Office multiple security vulnerabilities

Multiple memory corruptions on Microsoft Word documents parsing...

Threat Outbreak Alert: Fake Financial Documents Email Messages on January 14, 2014

Medium Alert ID: 32428 First Published: 2014 January 14 15:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake Bank Documents Email Messages on January 13, 2014

Medium Alert ID: 32417 First Published: 2014 January 14 15:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

CVE-2013-6997

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

CVE-2013-6997

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Open-Xchange Security Advisory 2014-01-06

Open-Xchange Security Advisory 2014-01-06 Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30203 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.0 and earlier Vulnerable component: backend Fixe...

Threat Outbreak Alert: Fake Financial Documents Email Messages on December 20, 2013

Medium Alert ID: 32251 First Published: 2013 December 23 14:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to op...

Threat Outbreak Alert: Fake Invoice Documents Attachment Email Messages on December 18, 2013

Medium Alert ID: 32216 First Published: 2013 December 18 17:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain invoice documents for the recipient. The text in the email message attempts to convince the...

NSA Officials Say Snowden Used Legitimate Access to Steal Data

It’s taken more than six months, but top officials at the National Security Agency are finally discussing some of the details of how former agency contractor Edward Snowden got access to all of the documents he stole and what kind of damage they believe the publication of the information they...

qt4-xml -- XML Entity Expansion Denial of Service

Richard J. Moore reports: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application...

Threat Outbreak Alert: Fake Bank Documents Email Messages on November 27, 2013

Medium Alert ID: 31931 First Published: 2013 December 2 20:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

CVE-2013-6622

Removed by vendor...

Microsoft Office Remote Code Execution Vulnerabilities (2885093)

This host is missing an important security update according to Microsoft Bulletin MS13-091. OpenVAS Vulnerability Test $Id: secpodms13-091.nasl 6079 2017-05-08 09:03:33Z teissa $ Microsoft Office Remote Code Execution Vulnerabilities 2885093 Authors: Antu Sanadi Copyright: Copyright c 2013 SecPod...

CVE-2013-3906: a graphics vulnerability exploited through Word documents

Recently we become aware of a vulnerability of a Microsoft graphics component that is actively exploited in targeted attacks using crafted Word documents sent by email. Today we are releasing Security Advisory 2896666 which includes a proactive Fix it workaround for blocking this attack while we...

CVE-2013-3906

creationtimestamp| type| source ---|---|--- 2013-11-05 07:00:00+00:00| seen| https://msrc.microsoft.com/blog/2013/11/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents/ 2013-11-08 08:57:29+00:00| seen| MISP/527ca75e-353c-4c91-a7d5-407a950d2109 2013-11-08 09:23:16+00:00| seen|...

NIST Reviews Crypto Standards Development

The National Institute for Standards and Technology has taken an important step toward repairing what the National Security Agency has allegedly fractured by initiating a review of its cryptographic standards development processes. NIST-sponsored algorithms are at the heart of numerous crypto...

CVE-2013-5596

The cycle collection CC implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial ...

Stack overflow

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote...