CVE-2018-0819

Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, such as phishing, due to how Outlook for Mac displays encoded email addresses, aka "Spoofing Vulnerability in Microsoft Office for Mac."...

CVE-2018-0819

CVE-2018-0819 affects Microsoft Office for Mac (Outlook for Mac) and is a spoofing vulnerability rooted in how email addresses are encoded/displayed. The issue allows an attacker to send a specially crafted email attachment that could cause spoofed addresses to bypass antivir/antispam tooling and...

Spoofing Vulnerability in Microsoft Office for MAC

A spoofing vulnerability exists when Microsoft Outlook for MAC does not properly handle the encoding and display of email addresses. This improper handling and display may cause antivirus or antispam scanning to not work as intended. To exploit the vulnerability, an attacker could send a speciall...

ASP.NET Core Elevation Of Privilege Vulnerability

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests. An attacker who successfully exploited this vulnerability could perform content injection attacks and run script in the security...

Security Round-up: Five Things We’ve Learned in 2017

The past 12 months have been packed with geopolitical incidents, global malware threats and ubiquitous big-name data breaches. From the CIA Vault7 and NSA Shadow Brokers leaks at the start of the year, to the WannaCry and NotPetya ‘ransomware’ campaigns, and Uber’s shocking revelations just last...

Nhash: petty pranks with big finances

According to our data, cryptocurrency miners are rapidly gaining in popularity. In an earlier publication we noted that cybercriminals were making use of social engineering to install this sort of software on users' computers. This time, we'd like to dwell more on how exactly the computers of...

RBKmoney: Text manipulation in https://checkout.rbk.money

Phishing / social engineering via text manipulation on html form labels...

Automatize Obfuscation and Generation of MS Office Documents: macro_pack

The macropack is a tool used to automatize obfuscation and generation of MS Office documents for pentest, demo, and social engineering assessments. The goal of macropack is to simplify antimalware solutions bypass and automatize the process from vba generation to final Office document generation...

Automated WPA Phishing Attacks: WiFiPhisher

Wifiphisher is a security tool that mounts automated victim-customized phishing attacks against WiFi clients in order to obtain credentials or infect the victims with malwares. It is primarily a social engineering attack that unlike other methods it does not include any brute forcing. It is an ea...

Microsoft Office Information Disclosure Vulnerability (CNVD-2018-00737)

Microsoft Office is an office software suite of products developed by the U.S. company Microsoft. An information disclosure vulnerability exists in Microsoft Office, which arises from the program's failure to properly process the contents of memory. An attacker could exploit this vulnerability by...

Young Hacker, Who Took Over Jail Network to Get Friend Released Early, Faces Prison

Well, "a friend in need is a friend indeed" goes a long way, but in this case, this phrase hardly makes any sense. A 27-year-old Michigan man who hacked into the government computer system of Washtenaw County Jail to alter inmate records and gain early release for his friend is now himself facing...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

Design/Logic Flaw

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery Vulnerability

Exploit for jsp platform in category web applications 1. Introduction Vendor: ZKTeco Affected Product: ZKTime Web - 2.0.1.12280 Fixed in: Vendor Website: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vulnerability Type: Cross Site Request Forgery Remote Exploitable: Yes CVE: CVE-2017-17056 ...

Unikrn: CSRF log victim into the attacker account

All the API endpoints v1 & v2 reflect sessionid to Set-Cookie response - which can lead victim to login attacker account, for example: Request: ====== POST /apiv1/ HTTP/1.1 Host: unikrn.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:57.0 Gecko/20100101 Firefox/57.0 Accept:...

Phoenix Framework Redirection Vulnerability

Phoenix Framework is a set of resource management and testing as one of the Web automation testing framework . The framework supports unscripted execution , unattended execution and free customization and other execution modes . A redirection vulnerability exists in Phoenix Framework. An attacker...

CVE-2017-1000163

The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks...

CVE-2017-1000163

The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks...

CVE-2017-1000163

The connected Nuclei template confirms a concrete open redirect vulnerability in Phoenix Framework versions 1.0.0–1.0.4, 1.1.0–1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0. The issue stems from unvalidated URL redirection, enabling phishing/social-engineering via crafted links. Impact is an attacker crafti...

10 tips for safe online shopping on Cyber Monday

Shoppers familiar with the Cyber Monday circus know they’re stepping into the lion’s den. The Internet has always been a lawless place, but it becomes particularly rough during the holiday shopping season. In preparation for the frenzy, cyber villains have crafted a virtual onslaught of social...