TrueConf Server Cross-Site Scripting Vulnerability (CNVD-2022-53542)

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server is vulnerable to a cross-site scripting vulnerability that originates from unknown code in the file /admin/conferences/get-all-status/, with the parameter...

TrueConf Server Cross-Site Scripting Vulnerability (CNVD-2022-53539)

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server contains a cross-site scripting vulnerability that can be exploited by remote attackers to perform basic cross-site scripting DOM attacks...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create ...

CVE-2022-31058

Tuleap SQL injection (CVE-2022-31058) affects Tuleap versions prior to 13.9.99.95. The issue arises from improper input sanitization when constructing SQL against tracker reports, enabling an attacker who can create a new tracker to execute arbitrary SQL queries. Connected sources corroborate imp...

CVE-2022-31063

Tuleap vulnerable before version 13.9.99.111 due to improper escaping of the document title in the MyDocmanSearch widget results and in the locked documents administration page. This can allow a malicious user who can create a document to trigger arbitrary code execution on a victim’s system. Aff...

CVE-2022-31032

Tuleap prior to version 13.9.99.58 is affected. The vulnerability arises from improper authorization verification when creating projects or trackers from template projects, allowing information disclosure from those templates. Remediation: upgrade to Tuleap 13.9.99.58 or newer. The available sour...

TAR Path Traversal in Zimbra (CVE-2022-41352)

This module creates a .tar file that can be emailed to a Zimbra server to exploit CVE-2022-41352. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in the cpio command- line utlity that can...

CVE-2022-31017

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...

CVE-2022-31017 Expression Always True vulnerability in Zulip Server

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...

Zimbra Collaboration Server < 8.6.0 P10 / 8.7 < 8.7.11 P1 / 8.8.x < 8.8.7 XSS

According to its self-reported version number, Zimbra Collaboration Server is affected by a cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function that allows remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email...

Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 30 XSS

According to its self-reported version number, Zimbra Collaboration Server is affected by a cross-site scripting XSS vulnerability in the Calendar feature, as exploited in the wild starting in December 2021. An attacker can place HTML containing executable JavaScript inside element attributes. Th...

Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place

Cervantes is an opensource collaborative platform for pentesters or red teams who want to save time to manage their projects, clients, vulnerabilities and reports in one place. Features OpenSource Multiplatform Multilanguage Team Collaboration BuiltIn dashbaords and analytics Manage your clients...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2022-59591)

Microsoft SharePoint Server is a remote code execution vulnerability in Microsoft SharePoint Server, an enterprise business collaboration platform from Microsoft Corporation. An attacker could use this vulnerability to execute arbitrary code on the system...

Zimbra Collaboration Server Installed (Linux / Unix)

Binary data zimbranixinstalled.nbin...

WordPress plugin Collaboration E-mails cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Collaboration E-mails 2.2.0 and earlier versions are vulnerable to cross-site request forgery, which stems from a lack of...

CVE-2022-1761

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more...

CVE-2022-1761

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more...

CVE-2022-1761

CVE-2022-1761 concerns the Peter’s Collaboration E-mails WordPress plugin (

CVE-2022-1761: Cross-Site Request Forgery (CSRF)

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more...