CVE-2019-11318: Improper Neutralization of Input During Web Page Generation

Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS...

CVE-2019-15313: Improper Neutralization of Input During Web Page Generation

In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability...

CVE-2014-8563: Improper Neutralization of Special Elements used in an OS Command

Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS...

PT-2020-9313

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration versions prior to 8.8.15 Patch 1 Description: The issue is related to a non-persistent XSS vulnerability via the Admin Console. Recommendations: For versions prior to 8.8.15 Patch 1, update to version 8.8.15 Patch 1 or...

PT-2020-9687

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions prior to 8.8.15 Patch 1 Description The issue is a non-persistent XSS vulnerability. Recommendations For versions prior to 8.8.15 Patch 1, update to version 8.8.15 Patch 1 or later to resolve the issue...

PT-2020-11339

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions 8.7.x through 8.8.11P2 Description The issue is related to non-persistent XSS. Recommendations For versions 8.7.x through 8.8.11P2, at the moment, there is no information about a newer version that contains a fix...

PT-2020-7753

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration versions prior to 8.0.9 Description The issue allows plaintext command injection during STARTTLS. Recommendations For versions prior to 8.0.9, update to version 8.0.9 or later to resolve the issue...

CVE-2019-8946: Improper Neutralization of Input During Web Page Generation

Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability (CNVD-2020-03756)

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is part of the Cisco Hosted Collaboration Solution HCS and is a core management component. A cross-site request forgery vulnerability exists in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment versions prior to 12.5...

Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal Vulnerability

A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software, Cisco TelePresence Codec TC Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected...

PT-2020-1388

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint CE Software affected versions not specified Cisco TelePresence Codec TC Software affected versions not specified Cisco RoomOS Software affected versions not specified Description A vulnerability in the...

PT-2020-1572

Name of the Vulnerable Software and Affected Versions Cisco Hosted Collaboration Mediation Fulfillment HCM-F affected versions not specified Description A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an unauthenticated, remote...

CVE-2019-19857

Affected product: Serpico 1.3.0 (SimplE RePort wrIting and CollaboratiOn tool). Vulnerability: Admin can change their password without providing the current password via interfaces outside the Change Password screen. This bypasses the Old Password check and is noted to be problematic in conjuncti...

INTERPOL Collaboration Reduces Cryptojacking by 78%

Cybercriminals are often seen as having the upper hand over the “white hat” community. After all, they’re anonymous, can launch attacks from virtually anywhere in the world, and usually have the element of surprise. But there’s one secret weapon the good guys have: Collaboration. That’s why Trend...

Policy and Disclosure: 2020 Edition

Posted by Tim Willis, Project Zero At Project Zero, we spend a lot of time discussing and evaluating vulnerability disclosure policies and their consequences for users, vendors, fellow security researchers, and software security norms of the the larger industry. We're very happy with how well our...

Celebrating Decades of Success with Microsoft at the Security 20/20 Awards

Effective collaboration is key to the success of any organization. But perhaps none more so than those working towards the common goal of securing our connected world. That’s why Trend Micro has always been keen to reach out to industry partners in the security ecosystem, to help us collectively...

2019 Hackathon Challenges Imperva to Solve Problems Together

The smell of pizza –150 boxes to be exact – filled our global offices last week as more than 220 Impervians technical and non-technical rolled up their sleeves to participate in Imperva’s annual company-wide hackathon. As chair of the event this year, I was determined to host a hackathon that...

Finding a common language to describe AI security threats

As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...

Cisco TelePresence Collaboration Endpoint CLI Arbitrary File Write

The vulnerability of the command-line interface CLI of the Cisco TelePresence Collaboration Endpoint CE device’s management software is related to improper handling of permissions. Exploiting this vulnerability could allow an attacker to write arbitrary files into the root directory...