Design/Logic Flaw

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API...

CVE-2018-10949

CVE-2018-10949 affects mailboxd in Zimbra Collaboration Suite (ZCS) prior to 8.8.8, 8.7 prior to 8.7.11.Patch3, and 8.6 prior to 8.6.0.Patch10. The vulnerability enables account enumeration by exploiting a discrepancy between HTTP 404 (account not active) and HTTP 401 (must authenticate) response...

CVE-2018-10949

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...

CVE-2018-10950

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump...

CVE-2018-10950

Summary: CVE-2018-10950 affects Zimbra Collaboration Suite mailboxd. Affected versions expose information through verbose error messages that include a stack dump, tracing data, or full user-context dump. Specific vulnerable ranges are: ZCS 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 befo...

CVE-2018-10951

CVE-2018-10951 affects Zimbra Collaboration Suite mailboxd. The vulnerability allows read access to the zimbraSSLPrivateKey via Admin SOAP API calls (GetServer, GetAllServers, GetAllActiveServers). Affected versions are ZCS 8.8 prior to 8.8.8; 8.7 prior to 8.7.11.Patch3; and 8.6 prior to 8.6.0.Pa...

CVE-2018-10951

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API...

CVE-2018-10950: Exposure of Sensitive Information to an Unauthorized Actor

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump...

PT-2018-10202

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6; versions 8.7 prior to 8.7.11.Patch3; versions 8.8 prior to 8.8.8 Description The issue allows account enumeration by exploiting a discrepancy between HTTP 404 and HTTP 401 error responses. This...

CVE-2018-10949: Observable Discrepancy

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...

PT-2018-10203

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6.0 through 8.6.0.Patch9 Zimbra Collaboration Suite versions 8.7.0 through 8.7.11.Patch2 Zimbra Collaboration Suite versions 8.8.0 through 8.8.7 Description The issue allows information exposure through...

PT-2018-10204 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.6.0 before Patch10 Zimbra Collaboration Suite versions 8.7.0 through 8.7.11.Patch2 Zimbra Collaboration Suite versions 8.8.0 through 8.8.7 Description: The issue allows read access to zimbraSSLPrivateKey...

CVE-2018-10951: Undefined Security Weakness

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API...

When Your Employees Post Passwords Online

Storing passwords in plaintext online is never a good idea, but it's remarkable how many companies have employees who are doing just that using online collaboration tools like Trello.com. Last week, KrebsOnSecurity notified a host of companies that employees were using Trello to share passwords f...

NIST Updates Cybersecurity Framework to Tackle Supply Chain Threats, Vulnerability Disclosure and More

Four years after the initial iteration was released, the National Institute of Standards and Technology NIST has released version 1.1 of the Framework for Improving Critical Infrastructure Cybersecurity. The framework was developed to be a voluntary, risk-based framework to improve cybersecurity...

Threat Outbreak Alert RuleID32559: Email Messages Distributing Malicious Software on April 26, 2018

Medium Alert ID: 57581 First Published: 2018 April 26 17:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32559 may contain the following files: Name | Si...

RSAC 2018: Tech Giants Form Cybersecurity Tech Accord

SAN FRANCISCO – Microsoft President Brad Smith during a keynote at the 2018 RSA Conference condemned government-backed cyberattacks as endangering innocent civilian’s lives – and said that tech companies need to come together to “open the world’s eyes to the impact that this is having.” At this...

The Cybersecurity Tech Accord: Time to Come Together to Combat Digital Threats

At Trend Micro we’re committed to making the world a safer place in which to exchange digital information. In fact, we’ve been protecting our customers from the ever-evolving threat landscape for nearly 30 years. But we know we can and must do more as an industry to combat the challenges we face...

Security baselines should underpin efforts to manage cybersecurity risk across sectors

This post is authored byAngela McKay, Director of Cybersecurity Policy and Amanda Craig, Senior Cybersecurity Strategist, CELA. Organizations are leveraging technology to transform their operations, products, and services, and governments are increasingly focusing on how to enable such dynamic...

Etherpad Arbitrary Code Execution Vulnerability (CNVD-2018-08480)

Etherpad is a Web-based online document collaboration tool. Multiple users can write a text document simultaneously via Etherpad and see real-time edits from all participants. An arbitrary code execution vulnerability exists in Etherpad 1.6.3. An attacker can exploit this vulnerability to execute...