Design/Logic Flaw

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...

CVE-2020-26547

Monal

CVE-2020-26547

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...

CentOS 8 : thunderbird (CESA-2020:2046)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:2046 advisory. - Mozilla: Use-after-free during worker shutdown CVE-2020-12387 - Mozilla: Arbitrary local file access with 'Copy as cURL' CVE-2020-12392 - Mozilla:...

Github Monal Data Falsification Issue Vulnerability

Github Monal is a cross-platform modern XMPP client for iOS and macOS. Monal before 4.9 suffers from a data forgery issue vulnerability that stems from not properly validating the sender of results. An attacker can use this vulnerability to inject arbitrary messages into local history and take fu...

WordPress Popup Builder plugin <= 3.71 - Authenticated Newsletter Send With Custom Content And Sender vulnerability

Authenticated Newsletter Send With Custom Content And Sender vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...

CVE-2020-35753

The job posting recommendation form in Persis Human Resource Management Portal Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20, when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter...

CVE-2020-35753

The job posting recommendation form in Persis Human Resource Management Portal Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20, when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter...

Cross site scripting

The job posting recommendation form in Persis Human Resource Management Portal Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20, when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter...

Persis Human Resource Management Portal Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Persis Human Resource Management Portal that originates in the SENDER parameter...

CVE-2020-35753

The CVE-2020-35753 issue affects Persis Human Resource Management Portal: versions 17.2.00–17.2.35 and 19.0.00–19.0.20, where the job posting recommendation form allows XSS via the SENDER parameter when the “Recommend job posting” function is enabled. The vulnerability is described as an XSS in t...

O1 Labs: SPF Records

The vulnerability was that you can spoof their email address and then the attacker can send emails from their email address which could lead to sending fake emails or attempts of phishing. To see if you can send an email of a target domain you need to check if it has an SPF Sender Policy Framewor...

Dovecot 2.3.11 - 2.3.11.3 DoS Vulnerability

Dovecot is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dovecot:dovecot";...

Malwarebytes: No SPF/DMARC records on mb-cosmos.com

The domain mb-cosmos.com lacked SPF and DMARC records, allowing email spoofing. Emails appeared to originate from the domain without authentication. This vulnerability was reported as a security issue...

Experts Warn of Privacy Risks Caused by Link Previews in Messaging Apps

Cybersecurity researchers over the weekend disclosed new security risks associated with link previews in popular messaging apps that cause the services to leak IP addresses, expose links sent via end-to-end encrypted chats, and even unnecessarily download gigabytes of data stealthily in the...

FIN11 Hackers Spotted Using New Techniques In Ransomware Attacks

A financially-motivated threat actor known for its malware distribution campaigns has evolved its tactics to focus on ransomware and extortion. According to FireEye's Mandiant threat intelligence team, the collective — known as FIN11 — has engaged in a pattern of cybercrime campaigns at least sin...

CVE-2020-1890

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

Dropbox: User has Sender permission can Get Team information

A security researcher was able to leverage a user with a sender role to view all team information by issuing a crafted POST request to portal.helloworks.com/editteam which provided information disclosure team's primary contact, whereas accessing the URL is forbidden based on the sender role. The...

Email Sender Identity is Key to Solving the Phishing Crisis

Email is in crisis. Despite massive advancements in perimeter and endpoint defenses, email remains a cybersecurity weak link for many companies. Why? Email is at the heart of everything we do online. It’s an essential line of communication for one-on-one and group conversations, both...

Multiple Huawei products improperly certified for vulnerability

The Huawei P30, among others, is a smartphone from the Chinese company Huawei Huawei. A security vulnerability exists in Huawei P30, P30 Pro and Tony-AL00B that stems from the program not properly authenticating the identity of the message sender. An attacker can exploit the vulnerability by...