Microsoft Office Security Bypass Vulnerability (CNVD-2018-15892)

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A security bypass vulnerability exists in Microsoft Office. The vulnerability arises because Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails...

CVE-2018-8310

Summary: CVE-2018-8310 is a tampering vulnerability in Microsoft Office/Outlook where specific attachment types rendered in HTML emails are mishandled, affecting Word and Office components. The issue enables tampering with content integrity (per CVSS3 I:H) and has network-level exposure with low ...

Microsoft Word 2013 Service Pack 1 Tampering Vulnerability (KB4022224)

This host is missing an important security update according to Microsoft KB4022224 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Security Updates for Microsoft Office Products (July 2018)

The Microsoft Office Products are missing security updates. They are, therefore, affected by a vulnerability : - A tampering vulnerability exists when Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails. An attacker could exploit the vulnerability by...

Timehop Hacked — Hackers Stole Personal Data Of All 21 Million Users

And the hacks just keep on coming. Timehop social media app has been hit by a major data breach on July 4th that compromised the personal data of its more than 21 million users. Timehop is a simple social media app that collects your old photos and posts from your iPhone, Facebook, Instagram,...

Security update for Mozilla Thunderbird (moderate)

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base MFSA 2018-16, bsc1098998: - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus -...

Threat Outbreak Alert RuleID33112: Email Messages Distributing Malicious Software on July 4, 2018

Medium Alert ID: 58352 First Published: 2018 July 5 15:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33112 may contain the following files: Name | Size...

UBUNTU-CVE-2018-12374

Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird 52.9...

Threat Outbreak Alert RuleID33096: Email Messages Distributing Malicious Software on July 3, 2018

Medium Alert ID: 58331 First Published: 2018 July 3 14:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33096 may contain the following files: Name | Size...

Reminder—Third Party Gmail Apps Can Read Your Emails, "Allow" Carefully!

Reminder—If you've forgotten about any Google app after using it once a few years ago, be careful, it may still have access to your private emails. When it comes to privacy on social media, we usually point fingers at Facebook for enabling third-party app developers to access users personal...

Typeform, Popular Online Survey Software, Suffers Data Breach

Typeform, the popular Spanish-based online data collection company specializes in form building and online surveys for businesses worldwide, has today disclosed that the company has suffered a data breach that exposed partial data of its some users. The company identified the breach on June 27th,...

Threat Outbreak Alert RuleID33053: Email Messages Distributing Malicious Software on June 26, 2018

Medium Alert ID: 58299 First Published: 2018 June 26 15:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33053 may contain the following files: Name | Siz...

WannaCry Extortion Fraud Reemerges

Extortion emails that threaten recipients with a WannaCry infection if they don’t pay up are making the rounds in the UK and elsewhere. The activity prompted an alert Friday from the City of London’s Action Fraud unit, which said at the time that police had already received almost 300 reports in...

A week in security (June 18 – June 24)

Last week, we took a deep dive into SamSam ransomware, looked at ways how to identify and delete malicious emails, recognized that there are now risks affecting job recruitment portals, analyzed a malicious Android app banking on the popularity of Fortnite, and identified causes and solutions for...

PSA: Recruitment portals and job sites at risk

Readers of Malwarebytes Labs aren't new to the social engineering tactics of malcontents to get users to respond to fake job offers via email. In 2014, we wrote about spam claiming to be from the recipient's supposed work application to a "Career Services Department," only to be redirected to a...

CVE-2018-6563

Multiple cross-site request forgery CSRF vulnerabilities in totemomail Encryption Gateway before 6.0.0Build371 allow remote attackers to hijack the authentication of users for requests that 1 change user settings, 2 send emails, or 3 change contact information by leveraging lack of an anti-CSRF...

CVE-2018-6563

Multiple cross-site request forgery CSRF vulnerabilities in totemomail Encryption Gateway before 6.0.0Build371 allow remote attackers to hijack the authentication of users for requests that 1 change user settings, 2 send emails, or 3 change contact information by leveraging lack of an anti-CSRF...

Email Phishers Using A Simple Way to Bypass MS Office 365 Protection

Security researchers have been warning about a simple technique that cyber criminals and email scammers are using in the wild to bypass most AI-powered phishing detection mechanisms implemented by widely used email services and web security scanners. Dubbed ZeroFont, the technique involves...

13 Ways Cyber Criminals Spread Malware

By David Balaban Security incidents where hackers distribute malicious code malware via spam, This is a post from HackRead.com Read the original post: 13 Ways Cyber Criminals Spread Malware...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks (CVE-2017-1357)

Summary IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. Vulnerability Details CVEID: CVE-2017-1357 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to...