Fastmail Fixes CSS Mutation Bugs but Remains Exposed to Hotwiring
Fastmail fixed two CSS mutation bugs and an image-proxy bypass, but CSS hotwiring and other techniques remain a concern for webmail security.
Category: Cyber Products
Cybersecurity products, tools, platforms and software categories.
Proton Mail Proxy Bypass Exposes Recipient IP Address
A Proton Mail vector demonstrated that a proxy bypass could expose the recipient's IP address, contradicting Proton's tracker-protection claims.
Yahoo Mail and AOL Mail Paste Race Leaks Login Tokens
A paste race in Yahoo Mail and AOL Mail on Firefox can leak Medium email-login tokens, allowing account takeover.
OpenAI Atlas Browser Vulnerable to Hidden Prompt Injection
CSS pseudo-elements and opacity can hide instructions from humans while AI models like OpenAI's Atlas read them, leading to data exfiltration. Atlas…
AOL Mail — Cybersecurity product profile
AOL Mail was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Atlassian Rovo: AI Assistant for Enterprise Data
Rovo is Atlassian's AI assistant that integrates with Jira, Confluence, and third-party apps. It has been found vulnerable to prompt injection attacks…
Jira: Project Management and Issue Tracking
Jira is Atlassian's project management and issue tracking tool. Data from Jira was targeted in prompt injection attacks against Rovo, potentially exposing…
Confluence: Team Collaboration and Documentation
Confluence is Atlassian's team collaboration and documentation platform. The RovoBlast attack demonstrated exfiltration of private API keys from Confluence, highlighting risks to…
Metabase Business Intelligence Software Affected by Critical Zero-Day
Metabase is a business intelligence and data visualization platform. A critical zero-day vulnerability (CVSS 10.0) allows unauthenticated attackers to inject SQL and…
Okta Targeted in UNC6671 Phishing Campaigns
Okta is a primary target for UNC6671's phishing kits and AitM attacks, with the group using fake Okta login pages to capture…