CVE-2019-9621

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component...

Design/Logic Flaw

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component...

CVE-2019-9621

The CVE-2019-9621 issue affects Zimbra Collaboration Suite (Prox yServlet) and enables SSRF through the ProxyServlet component. Connected docs confirm affected versions (8.6 patch 13; 8.7.x before 8.7.11 patch 10; 8.8.x before 8.8.10 patch 7 or before 8.8.11 patch 3) and show PoCs/exploits levera...

CVE-2019-9621

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component...

CVE-2019-9621

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component...

systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process

systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process This bug report describes a bug in systemd that allows a service with DynamicUser in collaboration with another service or user to create a setuid binary that can be used to access its UID beyond the lifetime of the...

systemd DynamicUser SetUID Binary Creation Exploit

This bug report describes a bug in systemd that allows a service with DynamicUser in collaboration with another service or user to create a setuid binary that can be used to access its UID beyond the lifetime of the service. This bug probably has relatively low severity, given that there are not...

systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process

This bug report describes a bug in systemd that allows a service with DynamicUser in collaboration with another service or user to create a setuid binary that can be used to access its UID beyond the lifetime of the service. This bug probably has relatively low severity, given that there aren't...

CVE-2019-1720

A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service DoS condition on an affected system. The vulnerability is due...

Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...

Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF Exploit

This Metasploit module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains a...

Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains an LDAP...

Cisco Prime Collaboration Provisioning Unauthorized Password Change Denial of Service Vulnerability (cisco-sa-20180801-pcp-dos

According to its self-reported version number, the remote Cisco Prime Collaboration Provisioning server is prior to 12.3. It is, therefore, affected by unauthorized password change denial of service vulnerability which could allow the attacker to cause the affected device to become inoperable,...

Cyber Security Week in Review (March 28)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. Top headlines this week ASUS had to release an emergency fix for a malware that may have accidentally deployed to their machines. Attackers may have...

SQL Injection Vulnerability in Xinhuo Collaboration Office System

Xinhuo Co-operation Office System is an open source and cross-platform office system. SQL injection vulnerability exists in Xinhao Collaboration Office System, which can be exploited by attackers to obtain sensitive information in the database...

Zimbra Remote Code Execution Vulnerability

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and a Web client. A remote code execution vulnerability exists in Zimbra, which can be exploited by an attacker to execute arbitrary code...

SQL Injection Vulnerability in Xinhuo Collaboration Office System ka***/ka***.php

Xinhuo Co-operation Office System is an office system based on php and mysql development. SQL injection vulnerability exists in ka/ka.php, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Xinhuo Collaboration Office System cu***/cu***.php

Xinhuo Co-operation Office System is an office system based on php and mysql development. SQL injection vulnerability exists in cu/cu.php, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Xinhuo Collaboration Office System we***/mo***/wo***.php

Xinhuo Co-operation Office System is an office system based on php and mysql development. SQL injection vulnerability exists in we/mo/wo.php, which can be exploited by attackers to obtain sensitive database information...