Mixmax: Security Vulnerability - SMTP protection not used

Hi, I'm checking your website found SPF record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...

Weblate: Email spoofing at weblate.org

Good day. I found security bug at weblate.org. Now anybody may send email from weblate.org domain. Now you have SPF policy and DMARC policy, that does not protect anything because exists insecure domain policy: "p=none" and "sp=none". Anybody may send email from weblate.org or subdomain, that are...

Weblate: Missing DMARC on weblate.org

Summary Email spoofing is possible due to missing SPF/Dmarc Records. Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575 Steps to reproduce: 1- Go to https://emkei.cz A Fake Mailer 2- Set the from to parameter as [email protected] or any other name, and send...

SMTP STS Coming Soon to Gmail, Other Webmail Providers

Gmail users can expect the introduction of SMTP Strict Transport Security to the email service some time this year, bringing a measure of security similar to certificate pinning to one of the world’s biggest webmail services. Elie Bursztein, the head of Google’s anti-abuse research team, said at...

Nextcloud: Missing SPF Flags on nextcloud.com

Hello NextCloud Details i just test your domain which is nextcloud.com and i surprised that i can send a legit email to a user. Impact Attacker can use this to send a Legit Email to the Victim and attacker can send a Malicious Web Links and Phishing Sites. Video Proof of Concept...

Update Rollup 4 for System Center 2012 R2 Orchestrator – SPF

Update Rollup 4 for System Center 2012 R2 Orchestrator – SPF This article describes the issues that are fixed in Update Rollup 4 for Microsoft System Center 2012 R2 Orchestrator – Service Provider Foundation. Additionally, this article contains the installation instructions for Update Rollup 4 fo...

GlobaLeaks: No valid SPF records on demo.globaleaks.org

User originally noticed www.globaleaks.org was without SPF record. This is out of scope, but demo.globaleaks.org lacks it as well. Marked as informative...

King Phisher 1.5.2 - Phishing Campaign Toolkit

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness...

Threat Outbreak Alert RuleID24271: Email Messages Distributing Malicious Software on August 12, 2016

Medium Alert ID: 48461 First Published: 2016 August 12 13:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24271 may contain the following files: Name |...

arxius: No SPF/DKIM/DMARC Record for lfil.es

For some reason he requested to disclose a duplicate report that's n/a anyway, so why not...

SimpleEmailSpoofer - A simple Python CLI to Spoof Emails (SPF/DMARC checking)

A few Python programs designed to help penetration testers with email spoofing. SimpleEmailSpoofer.py A program that spoofs emails. Currently in development spoofcheck.py A program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that...

Email Servers For More Than Half of World's Top Sites Can Be Spoofed

More than half of the world’s top sites suffer from misconfigured email servers, something that heightens the risk of having spoofed emails sent from their domains, researchers warn. Researchers at Detectify, a Swedish web security firm, recently combed through hundreds of domains and found that...

Paragon Initiative Enterprises: Email Authentication Bypass

Hi, I was able to bypass you email authentication. You have not published "DMARC Domain-based Message Authentication, Reporting, and Conformance" for the domain paragonie.com more information :- http://dmarc.org/ ---------------------------------------------------------------------- what is DMARC...

bitaccess: Missing SPF for hackerone.com

SPF was not correctly set on domains...

Paragon Initiative Enterprises: Vunerability : spf

Heĺlo sir, im an independent security researcher. I found an vunerability in your website Your website https://github.com/paragonie doesn't have valid spf records. To recover this do validate your spf. Sender Policy Framework SPF: This allows you specify which mail servers are allowed to send mai...

New Relic: Too many included lookups

Your SPF record required more than 10 DNS Lookups to be performed during the test. The number of "include" mechanisms and chained "redirect' modifiers should be kept to a minimum. According to RFC 4408, 'SPF implementations MUST limit the number of mechanisms and modifiers that do DNS Lookups to ...

Veris: Security Vulnerability - SMTP protection not used

Hi, I'm checking your website found SPF record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...

LeaseWeb: MISSING SPF RECORDS & MISSING DKIM POLICY

Missing SPF Records and DKIM policy ----------------------------------------------------- At this moment the leaseweb.com domain is missing the appropriate SPF records and DKIM policy. We are aware of the attack scenarios and currently working on a solution. We will add the missing SPF records an...

Gratipay: SPF/DKIM/DMARC for aspen.io

1.aspen.io 2.grtp.co SPF record lookup and validation for: grtp.co SPF records are published in DNS as TXT records. The TXT records found for your domain are: Checking to see if there is a valid SPF record. No valid SPF record found of either type TXT or type SPF. SPF record lookup and validation...

Gratipay: SPF/DKIM/DMARC for grtp.co

Hello Security Team, I Was Checking The SPF Record For https://grtp.co/ at http://www.kitterman.com/spf/validate.html No valid SPF record found of either type TXT or type SPF. Kindly Fix it Asap! Thanks!...