Cisco Prime Collaboration Provisioning Cleartext Passwords Written to World-Readable File Vulnerability

A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring...

Zimbra Collaboration Suite Cross-Site Scripting Vulnerability (CNVD-2018-10867)

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra, Inc. that includes WebMail, Calendar, Address Book, etc. Zimbra Web Client ZWC is one of the Web-based client applications. A cross-site scripting vulnerability exists in ZWC in versions 8.8 prior to Zimbra ZCS...

Zimbra Collaboration Suite Cross-Site Request Forgery Vulnerability

Zimbra Collaboration Suite a.k.a. ZCS is an open source collaboration suite from Zimbra, Inc. that includes WebMail, Calendar, Address Book, and more. A cross-site request forgery vulnerability exists in the login form in Zimbra ZCS versions prior to 8.6.0 Patch 10, 8.7.x versions prior to 8.7.11...

CVE-2018-10939

Zimbra Web Client ZWC in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the login form in Zimbra Collaboration Suite aka ZCS before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF...

Cross site scripting

Zimbra Web Client ZWC in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group...

CVE-2015-7610

Cross-site request forgery CSRF vulnerability in the login form in Zimbra Collaboration Suite aka ZCS before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF...

CVE-2018-10939

Zimbra Web Client ZWC in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group...

CVE-2015-7610

Cross-site request forgery CSRF vulnerability in the login form in Zimbra Collaboration Suite aka ZCS before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF...

CVE-2018-10939

Zimbra Collaboration Suite (ZCS) Web Client (ZWC) is affected by a persistent XSS issue in the ZWC component when used with ZCS versions 8.8.x before 8.8.8.Patch4 and 8.7.x before 8.7.11.Patch4. The vulnerability arises via a crafted contact group, enabling an attacker to inject arbitrary web scr...

CVE-2015-7610

Summary of CVE-2015-7610 : Zimbra Collaboration Suite (ZCS) is affected by a CSRF vulnerability in the login form observed in versions prior to 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1. The issue arises from failure to use a CSRF token, enabling remote attackers...

CVE-2018-10939

Zimbra Web Client ZWC in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group...

Botnet Operators Team Up To Leverage IcedID, Trickbot Trojans

The botnet operators behind two infamous banking trojans have banded together to gouge victims of cash in a tricky collaborative scheme. Flashpoint analysts, who highlighted the collaboration in a Wednesday report, said that the operators behind the IcedID and TrickBot trojans appear to be...

Want better apps? You need a (agile security) hero!

If weve learned anything from the rise of Marvel Cinematic Universe, its that good things tend to happen when heroes intervene. For securing new applications, this metaphor is a useful one because security isnt always top-of-mind for scrum teams, nor is it always conducive to meeting aggressive...

Partnerships power the future of better security

This post is authored by Jeremy Dallman, Principal Program Manager. Our goal in building the Microsoft Graph Security API is to enable customers to share insights and take action across security solutions to improve protection and speed response. By creating a connected security ecosystem,...

Zimbra Collaboration Suite mailboxd Information Disclosure Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra, Inc. that includes WebMail, Calendar, Address Book, and more. mailboxd is one of the email components. A security vulnerability exists in mailboxd in ZCS versions 8.8 before 8.8.8, 8.7 before 8.7.11.Patch3, and 8.6...

Zimbra Collaboration Suite mailboxd User Enumeration Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra, Inc. that includes WebMail, Calendar, Address Book, and more. mailboxd is one of the email components. A security vulnerability exists in mailboxd in ZCS versions 8.8 before 8.8.8, 8.7 before 8.7.11.Patch3, and 8.6...

CVE-2018-10950

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump...

CVE-2018-10949

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...

CVE-2018-10951

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API...