4236 matches found
Sylpheed Email Credential Gatherer
This module searches for credentials stored on Sylpheed email client on a Windows host. Module Options msf use post/windows/gather/credentials/sylpheed msf postsylpheed show actions ...actions... msf postsylpheed set ACTION msf postsylpheed show options ...show and set options... msf postsylpheed...
PT-2024-40046 · Ez Systems · Ez Platform
Name of the Vulnerable Software and Affected Versions: eZ Platform version 2.3.x Description: The issue allows unauthenticated users to bypass permission checks and read user data, including names and emails, but not passwords or password hashes. Recommendations: For eZ Platform version 2.3.x,...
PT-2024-40029 · Catalyst · Sentry
Name of the Vulnerable Software and Affected Versions: OpenCFP affected versions not specified Description: The issue concerns the third-party authentication framework Sentry, developed by Cartalyst, which is used in OpenCFP. It stems from how Sentry handles password reset checks, specifically wh...
CVE-2024-3676
The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These account...
CVE-2024-3676
The CVE-2024-3676 entry affects Proofpoint Encryption endpoint within Proofpoint Enterprise Protection. It is an Improper Input Validation vulnerability that allows an unauthenticated remote attacker to craft an HTTP request to create additional Encryption user accounts under the attacker’s contr...
Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls
Cybersecurity researchers have uncovered an ongoing social engineering campaign that bombards enterprises with spam emails with the goal of obtaining initial access to their environments for follow-on exploitation. "The incident involves a threat actor overwhelming a user's email with junk and...
PT-2024-27152 · Proofpoint · Proofpoint Enterprise Protection
Name of the Vulnerable Software and Affected Versions: Proofpoint Enterprise Protection affected versions not specified Description: The issue allows an unauthenticated remote attacker to create additional Encryption user accounts with a specially crafted HTTP request. These accounts can send...
FreeScout 注入漏洞
FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework. An injection vulnerability exists in versions prior to FreeScout 1.8.139 that stems from the presence of HTML injection, allowing an attacker to inject malicious HTML conte...
Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign
Polish government institutions have been targeted as part of a large-scale malware campaign orchestrated by a Russia-linked nation-state actor called APT28. "The campaign sent emails with content intended to arouse the recipient's interest and persuade him to click on the link," the computer...
APT42 Hackers Pose as Journalists to Harvest Credentials and Access Cloud Data
The Iranian state-backed hacking outfit called APT42 is making use of enhanced social engineering schemes to infiltrate target networks and cloud environments. Targets of the attack include Western and Middle Eastern NGOs, media organizations, academia, legal services and activists, Google Cloud...
NSA, FBI Alert on N. Korean Hackers Spoofing Emails from Trusted Sources
The U.S. government on Thursday published a new cybersecurity advisory warning of North Korean threat actors' attempts to send emails in a manner that makes them appear like they are from legitimate and trusted parties. The joint bulletin was published by the National Security Agency NSA, the...
CVE-2024-2109
The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'boosterextensionauthorboxshortcodedisplay' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails...
CVE-2024-3897 Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure
The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ayspbcreateauthor AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all...
PT-2024-18829 · WordPress · Booster Extension
Name of the Vulnerable Software and Affected Versions: Booster Extension plugin for WordPress version 1.2.0 and earlier Description: The issue allows unauthenticated attackers to extract sensitive data, including user emails, via the booster extension authorbox shortcode display function...
CVE-2024-2109: Missing Authorization
The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'boosterextensionauthorboxshortcodedisplay' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails...
VulnCheck KEV: CVE-2023-7028
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover...
Email Enumeration Attack
org.keycloak, keycloak-parent is vulnerable to Email Enumeration Attack. The vulnerability allows a logged-in user to enumerate valid account emails...
Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display
Description The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'boosterextensionauthorboxshortcodedisplay' function. This makes it possible for unauthenticated attackers to extract sensitive data including...
Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
Business email compromise BEC was the top threat observed by Cisco Talos Incident Response Talos IR in the first quarter of 2024, accounting for nearly half of engagements, which is more than double what was observed in the previous quarter. The most observed means of gaining initial access was t...
