PT-2020-7753

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration versions prior to 8.0.9 Description The issue allows plaintext command injection during STARTTLS. Recommendations For versions prior to 8.0.9, update to version 8.0.9 or later to resolve the issue...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability (CNVD-2020-03756)

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is part of the Cisco Hosted Collaboration Solution HCS and is a core management component. A cross-site request forgery vulnerability exists in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment versions prior to 12.5...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected...

Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal Vulnerability

A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software, Cisco TelePresence Codec TC Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is...

PT-2020-1388

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint CE Software affected versions not specified Cisco TelePresence Codec TC Software affected versions not specified Cisco RoomOS Software affected versions not specified Description A vulnerability in the...

PT-2020-1572

Name of the Vulnerable Software and Affected Versions Cisco Hosted Collaboration Mediation Fulfillment HCM-F affected versions not specified Description A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an unauthenticated, remote...

CVE-2019-19857

Affected product: Serpico 1.3.0 (SimplE RePort wrIting and CollaboratiOn tool). Vulnerability: Admin can change their password without providing the current password via interfaces outside the Change Password screen. This bypasses the Old Password check and is noted to be problematic in conjuncti...

INTERPOL Collaboration Reduces Cryptojacking by 78%

Cybercriminals are often seen as having the upper hand over the “white hat” community. After all, they’re anonymous, can launch attacks from virtually anywhere in the world, and usually have the element of surprise. But there’s one secret weapon the good guys have: Collaboration. That’s why Trend...

Policy and Disclosure: 2020 Edition

Posted by Tim Willis, Project Zero At Project Zero, we spend a lot of time discussing and evaluating vulnerability disclosure policies and their consequences for users, vendors, fellow security researchers, and software security norms of the the larger industry. We're very happy with how well our...

Celebrating Decades of Success with Microsoft at the Security 20/20 Awards

Effective collaboration is key to the success of any organization. But perhaps none more so than those working towards the common goal of securing our connected world. That’s why Trend Micro has always been keen to reach out to industry partners in the security ecosystem, to help us collectively...

2019 Hackathon Challenges Imperva to Solve Problems Together

The smell of pizza –150 boxes to be exact – filled our global offices last week as more than 220 Impervians technical and non-technical rolled up their sleeves to participate in Imperva’s annual company-wide hackathon. As chair of the event this year, I was determined to host a hackathon that...

Finding a common language to describe AI security threats

As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...

Cisco TelePresence Collaboration Endpoint CLI Arbitrary File Write

The vulnerability of the command-line interface CLI of the Cisco TelePresence Collaboration Endpoint CE device’s management software is related to improper handling of permissions. Exploiting this vulnerability could allow an attacker to write arbitrary files into the root directory...

SQL Injection Vulnerability in SeaChange Collaboration Office System

Wuhan Haichang Information Technology Co., Ltd. is a high-tech enterprise engaged in the research, development and sales of office automation software, collaboration management software and e-government software. An SQL injection vulnerability exists in the SeaChange Collaboration Office system,...

CVE-2019-15967

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...

Design/Logic Flaw

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...

CVE-2019-15967 Cisco TelePresence Collaboration Endpoint and RoomOS Audio Eavesdropping Vulnerability

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...

CVE-2019-15288: Improper Input Validation

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE, Cisco TelePresence Codec TC, and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input...

CVE-2019-15967: Improper Access Control

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...

PT-2019-4327

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software affected versions not specified Description The issue is related to a vulnerability in the CLI of the affected software, which could allow an authenticated, local attacker ...