CVE-2022-32272

OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation...

CVE-2022-32272

OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation...

Privilege escalation

OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation...

PT-2022-21197 · Opswat · Opswat Metadefender Core +2

Name of the Vulnerable Software and Affected Versions: OPSWAT MetaDefender Core versions prior to 5.1.2 OPSWAT MetaDefender ICAP versions prior to 4.12.1 OPSWAT MetaDefender Email Gateway Security versions prior to 5.6.1 Description: The issue is related to incorrect access control, which can...

CVE-2022-32272

CVE-2022-32272 affects OPSWAT MetaDefender Core prior to 5.1.2, MetaDefender ICAP prior to 4.12.1, and MetaDefender Email Gateway Security prior to 5.6.1. The issue is due to incorrect access control, enabling privilege escalation. The Red Hat advisory and related sources confirm the same affecte...

Spearphishing Attack Spoofs Microsoft.com to Target 200M Office 365 Users

A spearphishing attack is spoofing Microsoft.com to target 200 million Microsoft Office 365 users in a number of key vertical markets, including financial services, healthcare, manufacturing and utility providers. Researchers at Ironscales discovered the campaign targeting several thousand...

McAfee Email Gateway Web Mail User Interface Directory Traversal (SB10329)

The McAfee Email Gateway MEG application running on the remote host is affected by a directory traversal vulnerability in the Web Mail user interface. An authenticated, remote attacker can exploit this issue to traverse the file system to access files or directories that are outside of the...

McAfee Email Gateway Path Traversal Vulnerability

McAfee Email Gateway MEG is a suite of email security solutions from McAfee USA. A path traversal vulnerability in McAfee Email Gateway version 7.6.406, which originates in the email gateway, can be exploited by an attacker to gain access to locations outside of a restricted directory...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

Path traversal

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268

CVE-2020-7268 affects McAfee Email Gateway (MEG) prior to version 7.6.406, where a path traversal vulnerability allows remote attackers to construct input that accesses files/directories outside the restricted directory. The issue stems from how external input is used to form file paths in the ME...

CVE-2020-7268 McAfee Email Gateway (MEG) - Path Traversal vulnerability

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CISA Insights: Email-Based Attacks on Elections-Related Entities

The Cybersecurity and Infrastructure Security Agency CISA has released CISA Insights: Actions to Counter Email-Based Attacks on Elections-Related Entities in light of increased sophisticated phishing operations targeting individuals and groups involved in the upcoming U.S. elections. CISA strongl...

Spear-Phishing Attack Spoofs EE To Target Executives

Researchers warn of an ongoing spear-phishing attack mimicking a well-known telecommunications company, EE, to snatch up corporate executives’ credentials and payment details. Highly targeted emails have been sent to a few executives – including one at a leading financial firm – purporting to be...

But We Have an Email Gateway...

In my previous phishing blogs, I wrote about the evolution of phishing and the industrialization of phishing that's being driven by the availability and low cost of toolkits. In this blog post, I'm going to provide more information about emerging phishing attack vectors and how cybercriminals are...

CVE-2018-10353

A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability...

Trend Micro Encryption for Email Gateway formChangePass username SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

Trend Micro Encryption for Email Gateway register2 Client SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exist...

Trend Micro Encryption for Email Gateway LauncherServer DownloadBlackList Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists within the...