OpenPGP Information Disclosure Vulnerability

OpenPGP is a set of email encryption standards that supports multiple platforms. An information disclosure vulnerability exists in OpenPGP. An attacker could exploit this vulnerability to conduct a man-in-the-middle attack and obtain messages in plaintext form from encrypted emails...

EFAIL Opens Up Encrypted Email to Prying Eyes

A set of vulnerabilities in the encryption technologies used to secure sensitive emails threatens to expose corporate communications as well as the messages of at-risk users such as journalists, political dissidents and whistleblowers operating in hostile environments. However, there is some deba...

Details on a New PGP Vulnerability

A new PGP vulnerability was announced today. Basically, the vulnerability makes use of the fact that modern e-mail programs allow for embedded HTML objects. Essentially, if an attacker can intercept and modify a message in transit, he can insert code that sends the plaintext in a URL to a remote...

Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2018-10741)

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server that stems from Exchange failing to properly...

CVE-2018-10213

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it...

Google Redesigns Gmail – Here's a List of Amazing New Features

Google has finally been rolling out its new massively redesigned Gmail for desktop and mobile to 1.4 billion of users worldwide, which might be the most significant single upgrade in Gmail's history. This huge revamped version of the email service now offers plenty of new features such as...

Google Redesigns Gmail – Here's a List of Amazing New Features

Google has finally been rolling out its new massively redesigned Gmail for desktop and mobile to 1.4 billion of users worldwide, which might be the most significant single upgrade in Gmail's history. This huge revamped version of the email service now offers plenty of new features such as...

PT-2018-9760 · Vaultize · Vaultize Enterprise File Sharing

Name of the Vulnerable Software and Affected Versions: Vaultize Enterprise File Sharing version 17.05.31 Description: An issue was discovered where there is a cross-site scripting XSS vulnerability in the invitation mail received from a different user. This user can modify the HTML in the mail...

Energetic Bear/Crouching Yeti: attacks on servers

Energetic Bear/Crouching Yeti is a widely known APT group active since at least 2010. The group tends to attack different companies with a strong focus on the energy and industrial sectors. Companies attacked by Energetic Bear/Crouching Yeti are geographically distributed worldwide with a more...

Threat Outbreak Alert RuleID32525: Email Messages Distributing Malicious Software on April 20, 2018

Medium Alert ID: 57550 First Published: 2018 April 20 19:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32525 may contain the following files: Name | Si...

Multiple Vulnerabilities in Android App for US LinkSys Routers

Linksys Smart Wi-Fi Routers are smart Wi-Fi routers. An arbitrary user registration, information disclosure, and SMS bombing vulnerability exists in the US LinkSys Routers Android APP. Attackers use the vulnerability to register any email address and can send unlimited reset password emails,...

Threat Outbreak Alert RuleID32515: Email Messages Distributing Malicious Software on April 18, 2018

Medium Alert ID: 57535 First Published: 2018 April 18 19:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32515 may contain the following files: Name | Si...

Microsoft Office Information Disclosure (CVE-2018-0950)

A vulnerability exists in RTF based emails which cause information disclosure through Outlook on Windows. The vulnerability is due to an error in the way Microsoft Office improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a...

Threat Outbreak Alert RuleID32460: Email Messages Distributing Malicious Software on April 13, 2018

Medium Alert ID: 57481 First Published: 2018 April 13 19:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32460 may contain the following files: Name | Si...

Microsoft Office Information Disclosure Vulnerability (CNVD-2018-08640)

Microsoft Office 2010 SP2 and others are products of Microsoft Corporation.Microsoft Office 2010 SP2 is an office software suite product.Word 2007 SP3 is a word processing software. An information disclosure vulnerability exists in Microsoft Word and Office. A remote attacker can exploit this...

Threat Outbreak Alert RuleID32422: Email Messages Distributing Malicious Software on April 10, 2018

Medium Alert ID: 57459 First Published: 2018 April 10 20:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32422 may contain the following files: Name | Si...

IcedID Banking Trojan Teams up with Ursnif/Dreambot for Distribution

Update: 4/11 we have corrected the detection to Ursnif/Dreambot This post was authored by Ross Gibb with research contributions from Daphne Galme, and Michael Gorelik of Morphisec, a Cisco Security Technical Alliance partner. Cisco has noticed an increase in infections by the banking trojan IcedI...

Ongoing Threat of Ransomware

NCCIC has observed an increase in ransomware attacks across the world. Ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected...

Design/Logic Flaw

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...