4464 matches found
Poetry Argument Injection can lead to Local Code Execution
Observation When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are being constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoids Command Injection...
Security Bulletin: Multiple vulnerabilities in WebSphere Liberty affect SPSS Collaboration and Deployment Services
Summary There are multiple vulnerabilities in WebSphere Liberty used by SPSS Collaboration and Deployment Services. These issues have been addressed. Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are...
Design/Logic Flaw
Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL...
CVE-2022-36048 IP address leak via image proxy bypass in Zulip Server
Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL...
Vulnerability in TikTok Android app could lead to one-click account hijacking
Microsoft discovered a high-severity vulnerability in the TikTok Android application, which could have allowed attackers to compromise users’ accounts with a single click. The vulnerability, which would have required several issues to be chained together to exploit, has been fixed and we did not...
Vulnerability in TikTok Android app could lead to one-click account hijacking
Microsoft discovered a high-severity vulnerability in the TikTok Android application, which could have allowed attackers to compromise users’ accounts with a single click. The vulnerability, which would have required several issues to be chained together to exploit, has been fixed and we did not...
The vulnerability of the Calendar component in the Zimbra Collaboration Suite corporate email management system allows a hacker to insert any desired malicious code into documents.
The vulnerability of the Calendar component in the Zimbra Collaboration Suite enterprise email management system exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to insert arbitrary code into documents...
Zimbra Collaboration Suite mboximport path traversal
Added: 08/30/2022 Background Zimbra Collaboration Suite is an email, calendar, and collaboration solution for enterprises. Problem A path traversal vulnerability in the mboximport function could allow a remote attacker to create arbitrary JSP files within the web document root, leading to command...
Zimbra Collaboration Suite mboximport path traversal
Added: 08/30/2022 Background Zimbra Collaboration Suite is an email, calendar, and collaboration solution for enterprises. Problem A path traversal vulnerability in the mboximport function could allow a remote attacker to create arbitrary JSP files within the web document root, leading to command...
Metasploit Wrap-Up
Zimbra Auth Bypass to Shell Ron Bowes added an exploit module that targets multiple versions of Zimbra Collaboration Suite. The module leverages an authentication bypass CVE-2022-37042 and a directory traversal vulnerability CVE-2022-27925 to gain code execution as the zimbra user. The auth bypas...
Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite
Zimbra Unauthenticated Remote Code Execution Exploit CVE-2022-2...
Exploit for Path Traversal in Zimbra Collaboration
CVE-2022-37042 Zimbra CVE-2022-37042 Nuclei weaponized tem...
Zimbra Zip Path Traversal Exploit
This Metasploit module POSTs a ZIP file containing path traversal characters to the administrator interface for Zimbra Collaboration Suite. If successful, it plants a JSP-based backdoor within the web directory, then executes it. The core vulnerability is a path traversal issue in Zimbra...
Cybersecurity Analysts: Job Stress Is Bad, but Boredom Is Kryptonite
Years ago, “airline pilot” used to be a high-stress profession. Imagine being in personal control of equipment worth millions hurtling through the sky on an irregular schedule with the lives of all the passengers in your hands. But today on any given flight, autopilot is engaged almost 90% of the...
The vulnerability of the zmslapd function in the Zimbra Collaboration Suite’s email management system allows a hacker to execute arbitrary code.
The vulnerability of the zmslapd function in the Zimbra Collaboration Suite email management system is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 33 / 9.0.0 < 9.0.0 Patch 26 Multiple Vulnerabilities
According to its self-reported version number, Zimbra Collaboration Server is affected by a multiple vulnerabilities, including the following: - An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. The value of the X-Forwarded-Host...
The vulnerability of the import function in GitHub’s software platform, based on Git, for collaborative code development on GitLab, allows a perpetrator to execute arbitrary code.
The vulnerability of the import function in GitHub’s software platform for Git-based collaborative code development on GitLab is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the target system...
Cyber Signals: Defend against the new ransomware landscape
Today, Microsoft is excited to publish our second edition of Cyber Signals, spotlighting security trends and insights gathered from Microsoft’s 43 trillion security signals and 8,500 security experts. In this edition, we pull back the curtain on the evolving cybercrime economy and the rise of...
Cyber Signals: Defend against the new ransomware landscape
Today, Microsoft is excited to publish our second edition of Cyber Signals, spotlighting security trends and insights gathered from Microsoft’s 43 trillion security signals and 8,500 security experts. In this edition, we pull back the curtain on the evolving cybercrime economy and the rise of...
Uncovering a ChromeOS remote memory corruption vulnerability
Microsoft discovered a memory corruption vulnerability in a ChromeOS component that can be triggered remotely, allowing attackers to perform either a denial-of-service DoS or, in extreme cases, remote code execution RCE. Following our D-Bus blog post that focused on Linux, we searched for similar...