4236 matches found
What is a Botnet ❓ Definition, Types, Example Attack
Professionals, who make system security arrangements, are well-aware of the term ‘botnet’. Often used for the chain of hijacked computers/systems, the term ‘botnet’ should be well understood if a restorative and robust system is instructed as their wrong usage can lead to tremendous chaos. Botnet...
PT-2021-7305 · Roundcube +3 · Roundcube +3
Name of the Vulnerable Software and Affected Versions: Roundcube versions 1.4.13 and earlier, 1.5.x before 1.5.2 Description: The issue allows for cross-site scripting XSS attacks via crafted Cascading Style Sheets CSS token sequences in HTML e-mail messages. This can enable a remote attacker to...
CVE-2021-24945
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog...
PT-2021-16380 · WordPress · Likebtn
Name of the Vulnerable Software and Affected Versions: LikeBtn WordPress plugin versions prior to 2.6.38 Description: The issue concerns a lack of authorization and CSRF checks in the likebtn export votes AJAX action. This could allow any authenticated user, such as a subscriber, to obtain a list...
Improper Access Control in bookstackapp/bookstack
Description A logged-in user with no privileges OR guest user if public access enabled can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user...
Next-Gen Maldocs & How to Solve the Human Vulnerability
Any cybersecurity attack — whether it be a breach, an incident or any form of compromise — starts with hackers getting in through the door. Threat actors and adversaries rely on gaining code execution on a target system which they can then leverage to do more damage—a phase commonly referred to a...
Solidus 安全漏洞
Solidus is an open source e-commerce system. Solidus suffers from a security vulnerability that stems from the fact that the software's regular expressions in emails used to validate guest orders can be exponentially backtracked through fragments such as a.a.a, which can be exploited by an attack...
Denial of Service in chatwoot/chatwoot
The extractreply function https://github.com/chatwoot/chatwoot/blob/a0ffefad717b632269883863c27242bb97d3b66d/app/presenters/mailpresenter.rbL105 is highly inefficient on HTML emails. A legitimate LinkedIn email has 20kb of HTML content which takes a minute or two to process through that function,...
The vulnerability of the mail client in operating systems such as iOS, iPadOS, and watchOS allows a hacker to cause a service failure.
The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
The vulnerability of the mail client in operating systems such as iOS, iPadOS, and watchOS allows a hacker to trigger a service failure.
The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist
The cold war between a startup and a soft-serve machine manufacturer is heating up, thanks to a newly released trove of internal emails...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90762)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
CVE-2021-38375
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...
CVE-2021-38377
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...
Open-xchange OX App Suite 跨站脚本漏洞
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
How Iran Tried to Undermine the 2020 US Presidential Election
From faked emails to a hacked voter registration database, a new indictment offers fresh details on the attempted interference...
Phishing Scam Aims to Hijack TikTok ‘Influencer’ Accounts
A recently discovered phishing scam tried to takeover more than 125 high-profile user accounts on TikTok. Researchers said the campaign marks one of the first major attacks on “influencers” found on the TikTok social-media platform. Researchers at cloud email security provider Abnormal Security...
Hacker accessed FBI server to send fake email threats
By Waqas The FBI has categorically denied sending spam emails from its server, which according to reports, hit 100,000 inboxes. This is a post from HackRead.com Read the original post: Hacker accessed FBI server to send fake email threats...
Cross-Site Request Forgery (CSRF) in pterodactyl/panel
Description Following state-changing endpoints are vulnerable to CSRF: 1: GET /admin/nodes/view/1/settings/token auto-generates token when token not generated yet 2: GET /admin/settings/mail/test The X-CSRF-Token header for the API request is not validated on backend, should be a POST request to...
NEX-Forms <= 7.9.4 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings and form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. In Global Setting Preferences Validation, put the following...