The vulnerability of the mail client in operating systems such as iOS, iPadOS, and watchOS allows a hacker to cause a service failure.

The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist

The cold war between a startup and a soft-serve machine manufacturer is heating up, thanks to a newly released trove of internal emails...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90762)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

CVE-2021-38377

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...

CVE-2021-38375

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...

Open-xchange OX App Suite 跨站脚本漏洞

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

How Iran Tried to Undermine the 2020 US Presidential Election

From faked emails to a hacked voter registration database, a new indictment offers fresh details on the attempted interference...

Phishing Scam Aims to Hijack TikTok ‘Influencer’ Accounts

A recently discovered phishing scam tried to takeover more than 125 high-profile user accounts on TikTok. Researchers said the campaign marks one of the first major attacks on “influencers” found on the TikTok social-media platform. Researchers at cloud email security provider Abnormal Security...

Hacker accessed FBI server to send fake email threats

By Waqas The FBI has categorically denied sending spam emails from its server, which according to reports, hit 100,000 inboxes. This is a post from HackRead.com Read the original post: Hacker accessed FBI server to send fake email threats...

Cross-Site Request Forgery (CSRF) in pterodactyl/panel

Description Following state-changing endpoints are vulnerable to CSRF: 1: GET /admin/nodes/view/1/settings/token auto-generates token when token not generated yet 2: GET /admin/settings/mail/test The X-CSRF-Token header for the API request is not validated on backend, should be a POST request to...

NEX-Forms <= 7.9.4 - Multiple Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings and form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. In Global Setting Preferences Validation, put the following...

Tiny Font Size Fools Email Filters in BEC Phishing

A new business email compromise BEC campaign targeting Microsoft 365 users is using a range of sophisticated obfuscation tactics within phishing emails that can fool natural language processing filters and are undetectable to end users. Researchers at Avanan, a CheckPoint company, first discovere...

TrickBot Operators Partner with Shathak Attackers for Conti Ransomware

The operators of TrickBot trojan are collaborating with the Shathak threat group to distribute their wares, ultimately leading to the deployment of Conti ransomware on infected machines. "The implementation of TrickBot has evolved over the years, with recent versions of TrickBot implementing...

CVE-2021-39911

An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers...

Cisco Email Security Appliance Denial of Service Vulnerability

The Cisco Email Security Appliance ESA is an email security appliance from Cisco USA. A denial of service vulnerability exists in the Cisco Email Security Appliance, which is caused by insufficient validation of incoming email input. An attacker could exploit this vulnerability to perform a denia...

CVE-2021-34741

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to perform a denial of service DoS attack against an affected device. This vulnerability is due to insufficient input validation of...

CVE-2021-34741

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to perform a denial of service DoS attack against an affected device. This vulnerability is due to insufficient input validation of...

Cisco Webex Meetings 安全漏洞

An input validation error vulnerability exists in Cisco Webex Meetings, a video conferencing solution from Cisco, which stems from insufficient validation of user-supplied parameters in the product. An attacker could send an activation email to an increasingly account through this vulnerability...

Spam and phishing in Q3 2021

Quarterly highlights Scamming championship: sports-related fraud This summer and early fall saw some major international sporting events. The delayed Euro 2020 soccer tournament was held in June and July, followed by the equally delayed Tokyo Olympics in August. Q3 2021 also featured several F1...

A week in security (Oct 25 – Oct 31)

Last week on Malwarebytes Labs Beyond the VPN: Ultimate online privacy with the Tor Project’s Isabela Bagueros: Lock and Code S02E20 Patch now to bypass Firefox add-ons that abuse the proxy API to deny updates How social media mistakes can impact cybersecurity Update now! Apple patches bugs in iO...