Dotclear admin/auth.php file cross-site scripting vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/auth.php file in Dotclear version 2.12.1. This vulnerability can be exploited by remote attackers to inject arbitrary web...

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...

CVE-2017-16862

The CVE-2017-16862 issue affects Atlassian Jira’s IncomingMailServers resource. A CSRF vulnerability in Jira versions before 7.6.2 lets remote attackers modify the coming mail whitelist setting. The problem arises from the CSRF in the IncomingMailServers component, enabling manipulation without ...

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...

[SECURITY] Fedora 27 Update: awstats-7.6-8.fc27

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

Bitcoin Blackmail by Snail Mail Preys on Those with Guilty Conscience

KrebsOnSecurity heard from a reader whose friend recently received a remarkably customized extortion letter via snail mail that threatened to tell the recipient's wife about his supposed extramarital affairs unless he paid $3,600 in bitcoin. The friend said he had nothing to hide and suspects thi...

Buffer overflow

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

CVE-2017-17946

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

CVE-2017-17946

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

[SECURITY] Fedora 27 Update: thunderbird-52.5.2-1.fc27

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 26 Update: thunderbird-52.5.2-1.fc26

Mozilla Thunderbird is a standalone mail and newsgroup client...

A week in security (January 1 – January 7)

New year, new threats, as 2018 gets underway. On our blog, we had dubious searches aplenty for those hunting for Malwarebytes information, and we also covered the huge Meltdown/Spectre bug, affecting hardware going back to 10 years. Other news Coin miners are at it again, with a proof of concept...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

Nylas Mail Lives Information Disclosure Vulnerability

Nylas Mail Lives is an open source, extensible desktop mail application. A security vulnerability exists in Nylas Mail Lives version 2.2.2, which stems from the program assigning 0755 privileges to $HOME/.nylas-mail. A local attacker can exploit the vulnerability to obtain sensitive authenticatio...

TYPO3 Direct Mail Extended Authentication Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. direct Mail is one of the extensions to send mail without the need for SMTP servers . An authentication bypass vulnerability exists in the TYPO3 Direct Mail extension. An attacke...

Unspecified Vulnerability in Apple iOS Mail Message Framework

Apple iOS is an operating system developed by Apple for mobile devices, and Mail Message Framework is one of the components of the e-mail message framework. A security vulnerability exists in the Mail Message Framework component of Apple iOS. The vulnerability can be exploited by a remote attacke...

Authentication flaw

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...

CVE-2017-1000485

Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations...