CVE-2022-41349

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41349

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41351

In Zimbra Collaboration Suite ZCS 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string instead of default value of 10...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41349

CVE-2022-41349 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a Reflected XSS in the /h/compose endpoint, where the attachUrl parameter is not properly sanitized, allowing execution of arbitrary JavaScript in a victim’s browser. Affected product/version: ZCS 8.8.15. Underly...

CVE-2022-41348

An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41348

An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...

Zimbra Collaboration Suite 跨站脚本漏洞

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Zimbra Collaboration Suite version 9.0.0, which stems from the lack of effective filtering...

CVE-2022-41350

CVE-2022-41350 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a Reflected XSS in the /h/search?action=voicemail&action=listen endpoint where the phone parameter is not properly sanitized, allowing execution of arbitrary JavaScript on the victim’s machine. Public documents c...

Exploit for Path Traversal in Zimbra Collaboration

cve-2022-41352 generate poc.tar $ chmod +x cpiopocgen...

The Internet Architecture Board Takes on Sustainability

Join Akamai and the Internet Architecture Board to make shift happen. Let's work together to make life better for billions of people, billions of times a day. GreenWithAkamai...

Malwarebytes' modernized bug bounty program—here's all you need to know

Malwarebytes welcomes and encourages independent researchers reporting vulnerabilities in our products, and has run a bug bounty program for several years. Our security team has spent the last few months modernizing the program and we thought you'd like to hear about it. What is a bug bounty...

Exploitation of Unpatched Zero-Day Remote Code Execution Vulnerability in Zimbra Collaboration Suite (CVE-2022-41352)

Note: Zimbra release 9.0.0 P27 addressed this vulnerability on October 10, 2022. CVE-2022-41352 is an unpatched remote code execution vulnerability in Zimbra Collaboration Suite discovered in the wild due to active exploitation. The vulnerability is due to the method cpio in which Zimbra’s...

What's New in InsightIDR: Q3 2022 in Review

This Q3 2022 recap post takes a look at some of the latest investments we've made to InsightIDR to drive detection and response forward for your organization. 360-degree XDR and attack surface coverage with Rapid7 The Rapid7 XDR suite — flagship InsightIDR, alongside InsightConnect SOAR, and Thre...

The vulnerability of the cpio archiving utility in the Zimbra Collaboration Suite enterprise email system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cpio archiving utility in the Zimbra Collaboration Suite enterprise email system is related to the unlimited loading of dangerous type files into the opt/zimbra/jetty/webapps/zimbra/public directory. Exploiting this vulnerability could allow a malicious actor, operating...

collaboration.lism.catholic.edu.au Cross Site Scripting vulnerability OBB-2974900

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

CVE-2022-27925 Zimbra RCE 2022 This repo is part of the...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

CVE-2022-27925 Zimbra RCE 2022 This repo is part of the...

Vulnerability found in Zimbra Collaboration

A vulnerability has been fixed in Zimbra Collaboration Suite ZCS. The vulnerability allows a malicious party to launch attacks execute attacks that result in the following categories of damage: Manipulation of data. Bypassing authentication Remote code execution Administrator/Root privileges The...