110 matches found
PT-2019-6062
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.7.x through 8.7.11p9 Description The issue is related to an XML External Entity injection XXE vulnerability in the mailboxd component of the Zimbra Collaboration Suite, specifically affecting the...
CVE-2019-9670: Improper Restriction of XML External Entity Reference
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...
Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...
Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF
This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains an LDAP...
Nagios XI elevation of privilege vulnerability (CNVD-2018-23141)
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An elevation of privilege vulnerability exists in Nagios XI 5.5.6. A locally authenticated attacker can exploit this vulnerability to...
CVE-2018-15710
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscovernew.php...
PT-2018-13160
Name of the Vulnerable Software and Affected Versions Nagios XI version 5.5.6 Description The issue allows local authenticated attackers to escalate privileges to root. This is achieved via the Autodiscover new.php file. Recommendations For Nagios XI version 5.5.6, update to a version that contai...
May 17, 2018—KB4103722 (OS Build 15063.1112)
None None...
April 23, 2018—KB4093105 (OS Build 16299.402)
None None...
Mail.ru: blind XXE in autodiscover parser
Как воспроизвести: 1 Закинуть на сервер атакующего xml должен быть доступен на сервере атакующего по адресу /autodiscover/autodiscover.xml: Я сделал такой ответ при запросе любой xml'ки: obmhld.com/autodiscover/autodiscover.xml email settings SMTP 52.34.103.214 1191 off [email protected] yandex....
The vulnerability of the Exchange ActiveSync component of the iOS operating system allows a hacker to delete data from the device.
The vulnerability of the Exchange ActiveSync component of the iOS operating system is related to improper handling of permissions during account setup. Exploiting this vulnerability allows a malicious actor to delete data from the device during account setup, by capturing the open AutoDiscover V1...
CVE-2017-7088
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attackers to erase a device in opportunistic circumstances by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange accoun...
CVE-2017-7088
The CVE-2017-7088 entry affects iOS prior to 11 in the Exchange ActiveSync (EAS) AutoDiscover V1 workflow. Root cause: a vulnerability allowing an attacker who can observe the AutoDiscover V1 session to hijack a cleartext exchange during Exchange account setup, enabling the attacker to erase the ...
CVE-2017-7088: Undefined Security Weakness
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attackers to erase a device in opportunistic circumstances by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange accoun...
Apple iOS Exchange ActiveSync Authentication Vulnerability
Apple iOS is an operating system developed by Apple for mobile devices.Exchange ActiveSync is one of the Microsoft Exchange synchronization protocols. A security vulnerability exists in the Exchange ActiveSync component in versions of Apple iOS prior to 11. A remote attacker can exploit this...
PT-2017-3077
Name of the Vulnerable Software and Affected Versions iOS versions prior to 11 Description The issue involves the Exchange ActiveSync component and allows remote attackers to erase a device by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange account. This occurs due t...
Description of the security update for Outlook 2016: June 13, 2017
None None...
Description of the security update for Outlook 2013: June 13, 2017
Description of the security update for Outlook 2013: June 13, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...