5383 matches found
CISA Releases Security Advisory for Philips Vue PAC Products
CISA has released an Industrial Controls Systems ICS Medical Advisory detailing multiple vulnerabilities in multiple Philips Clinical Collaboration Platform Portal officially registered as Vue PACS products. An attacker could exploit some of these vulnerabilities to take control of an affected...
Ransomware Defense: Top 5 Things to Do Right Now
If there is any cyber-threat at the top of everyone’s mind right now, it must be ransomware. Once a “nuisance” threat, ransomware has grown into a layered, multi-billion-dollar industry for attackers. These threat actors are no longer amateurs trying their hand at breaking and entering. Rather, w...
Zimbra Collaboration Suite Cross-Site Scripting Vulnerability
Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. A cross-site scripting vulnerability exists in the login component of the web client for Zimbra Collaboration Suite. An attacker could exploit this vulnerability by adding executable...
Zimbra Collaboration Suite Open Redirect Vulnerability
Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. An open redirection vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite. An attacker obtaining a valid zimbra authentication token or a valid preauth token could...
jSonar to Begin a New Chapter in Collaboration
A message from JSonar co-founder and CTO, Ron Bennatan. My wife complains that I’m a boring person. I’ve been doing the same thing for 25 years now – databases, then security, then database security, then data security and then some data lake security. But by that account Tom Brady is a boring...
CVE-2021-35209
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...
CVE-2021-34807
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...
CVE-2021-35207
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...
CVE-2021-35209
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...
CVE-2021-35208
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...
CVE-2021-34807
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...
Design/Logic Flaw
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...
Design/Logic Flaw
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...
CVE-2021-35208
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...
Cross site scripting
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...
Open redirect
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...
CVE-2021-35207
CVE-2021-35207 reports an XSS in the Zimbra Web Client login component. A attacker could inject executable JavaScript via the loginErrorCode parameter in the login URL to trigger client-side script execution. Affected software includes Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23 and 9...
CVE-2021-35207
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...
CVE-2021-35207
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...
CVE-2021-35208
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...