dovecot: Resource exhaustion via deeply nested MIME parts

A flaw was found in dovecot. A remote attacker could cause a denial of service by repeatedly sending emails containing MIME parts containing malicious content of which dovecot will attempt to parse. The highest threat from this vulnerability is to system availability...

Information Disclosure

derhansen/sfeventmgt is vulnerable to information disclosure. Missing access checks in the backend module allows an authenticated user to export restricted participant data for events or send emails to event participants for events which the user does not have access to...

Cisco Jabber for Windows Command Injection Vulnerability

Cisco Jabber for Windows and Cisco Jabber are both products of the U.S. Cisco Cisco.Cisco Jabber for Windows is a set of unified communications client solutions for the Windows platform. The program provides online status display, instant messaging, voice and other functions.Cisco Jabber is a...

GHSA-G8RG-7RPR-CWR2 Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...

GitLab: Able to leak private email of any user given his/her username via graphql

Summary Graphql query user is leaking private email of users query userusername:"" email username Steps to reproduce Step-by-step guide to reproduce the issue, including: Have a account with private email settings Use graphql query to access the private email query userusername:"" email username...

Are employees the weakest link in your security strategy? Train them!

Email is the number one threat vector. There’s no exception, even with a global pandemic, on the contrary: COVID-19 has been used as an appealing hook by cyber criminals. Data from Trend Micro Smart Protection Network shows that for the first five months of 2020, 92 per cent of all the cyber...

A Google Drive 'Feature' Could Let Attackers Trick You Into Installing Malware

An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate. The latest security issue—of which Google...

Google vulnerability allowed sending spoofed emails with Gmail ID

By Sudais Asif Google fixed the vulnerability after the security researcher ended up disclosing its technical details online. This is a post from HackRead.com Read the original post: Google vulnerability allowed sending spoofed emails with Gmail ID...

Dropcontact: User registration using public domain email like gmail in place of professional email.

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...

ReconSpider - Most Advanced Open Source Intelligence (OSINT) Framework For Scanning IP Address, Emails, Websites, Organizations

ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers, Penetration Testers, Bug Hunters and Cyber Crime Investigators to find de...

Incident Response Analyst Report 2019

Download full report PDF As an incident response service provider, Kaspersky delivers a global service that results in global visibility of adversaries cyber-incident tactics and techniques used in the wild. In this report, we share our teams conclusions and analysis based on incident responses a...

Sulu Information Disclosure Vulnerability

Sulu is an extensible, PHP-based open source content management system on the Symfony framework from Sulu Austria. A security vulnerability exists in Sulu versions prior to 1.6.35, prior to 2.0.10, and prior to 2.1.1. An attacker can exploit the vulnerability to retrieve valid usernames as well a...

US Government Warns of a New Strain of Chinese 'Taidoor' Virus

Intelligence agencies in the US have released information about a new variant of 12-year-old computer virus used by China's state-sponsored hackers targeting governments, corporations, and think tanks. Named "Taidoor," the malware has done an 'excellent' job of compromising systems as early as...

New Relic: HTML injection at Alert email

@wi11 discovered an issue with Alerts notification emails where supplied HTML tags would be rendered by the email generator. This could allow an attacker to embed arbitrary hyperlinks or images under the header in those Alerts emails. Some prople asked me about this bug, so I give a simple...

Avoid these PayPal phishing emails

For the last few weeks, there’s been a solid stream of fake PayPal emails in circulation, twisting FOMO fear of missing out into DO THIS OR BAD THINGS WILL HAPPEN. It’s one of the most common tools in the scammer’s arsenal, and a little pressure applied in the right way often brings results for...

Crypto wallet Ledger data breach; hackers steal 1m emails & other data

By Sudais Asif Ledger has acknowledged that hackers also gained access to 9500 Phone... This is a post from HackRead.com Read the original post: Crypto wallet Ledger data breach; hackers steal 1m emails & other data...

WordPress Email Subscribers & Newsletters Cross-Site Request Forgery Vulnerability (CNVD-2020-44908)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A cross-site request forgery vulnerability...

Emotet Returns in Malspam Attacks Dropping TrickBot, QakBot

Emotet has returned after a five-month hiatus. Researchers first spotted the malware in a campaign that has spammed Microsoft Office users with hundreds of thousands of malicious emails since Friday. The malware first emerged in 2014, but has since then evolved into a full fledged botnet that’s...

Diebold ATM Terminals Jackpotted Using Machine’s Own Software

Cybercriminals are using software from leading ATM manufacturer Diebold in a series of hacks against cash terminals across Europe, forcing the machines to dispense cash to crooks. Criminals using a black-box device common with these type of attacks have increased their activity across Europe by...

CVE-2020-5767

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...