Spearphishing Attack Spoofs Microsoft.com to Target 200M Office 365 Users

A spearphishing attack is spoofing Microsoft.com to target 200 million Microsoft Office 365 users in a number of key vertical markets, including financial services, healthcare, manufacturing and utility providers. Researchers at Ironscales discovered the campaign targeting several thousand...

McAfee Email Gateway Web Mail User Interface Directory Traversal (SB10329)

The McAfee Email Gateway MEG application running on the remote host is affected by a directory traversal vulnerability in the Web Mail user interface. An authenticated, remote attacker can exploit this issue to traverse the file system to access files or directories that are outside of the...

McAfee Email Gateway Path Traversal Vulnerability

McAfee Email Gateway MEG is a suite of email security solutions from McAfee USA. A path traversal vulnerability in McAfee Email Gateway version 7.6.406, which originates in the email gateway, can be exploited by an attacker to gain access to locations outside of a restricted directory...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

Path traversal

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268

CVE-2020-7268 affects McAfee Email Gateway (MEG) prior to version 7.6.406, where a path traversal vulnerability allows remote attackers to construct input that accesses files/directories outside the restricted directory. The issue stems from how external input is used to form file paths in the ME...

CVE-2020-7268 McAfee Email Gateway (MEG) - Path Traversal vulnerability

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

PT-2020-19514

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway MEG versions prior to 7.6.406 Description The issue allows remote attackers to access files or directories outside of the restricted directory by constructing a path name that should be within a restricted directory via...

CVE-2020-7268: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CISA Insights: Email-Based Attacks on Elections-Related Entities

The Cybersecurity and Infrastructure Security Agency CISA has released CISA Insights: Actions to Counter Email-Based Attacks on Elections-Related Entities in light of increased sophisticated phishing operations targeting individuals and groups involved in the upcoming U.S. elections. CISA strongl...

Spear-Phishing Attack Spoofs EE To Target Executives

Researchers warn of an ongoing spear-phishing attack mimicking a well-known telecommunications company, EE, to snatch up corporate executives’ credentials and payment details. Highly targeted emails have been sent to a few executives – including one at a leading financial firm – purporting to be...

But We Have an Email Gateway...

In my previous phishing blogs, I wrote about the evolution of phishing and the industrialization of phishing that's being driven by the availability and low cost of toolkits. In this blog post, I'm going to provide more information about emerging phishing attack vectors and how cybercriminals are...

CVE-2018-10353

A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability...

Trend Micro Encryption for Email Gateway register2 Client SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exist...

Trend Micro Encryption for Email Gateway editPolicy hidRuleId SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL statements on vulnerable installations of Trend Micro Encryption of Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

Trend Micro Encryption for Email Gateway LauncherServer DownloadBlackList Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists within the...

Trend Micro Encryption for Email Gateway DBCrypto Authentication Weakness Vulnerability

This vulnerability allows attackers to recover user passwords on vulnerable installations of Trend Micro Encryption for Email Gateway. An attacker must first obtain access to the user database on the target system in order to exploit this vulnerability. The specific flaw exists within the DBCrypt...

Trend Micro Encryption for Email Gateway formConfiguration saveValue SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Encryption for Email Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within t...