CVE-2019-6980

CVE-2019-6980 affects Synacor Zimbra Collaboration Suite (Zimbra Collaboration Server) 8.7.x through 8.8.11, with insecure object deserialization in the IMAP component as the root cause. The issue is evidenced across multiple feeds (NVD/Nessus/Red Hat) and is rated high/critical (CVSS v3.0: 9.8; ...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

CVE-2019-9670

CVE-2019-9670 affects Synacor Zimbra Collaboration Suite (mailboxd) prior to 8.7.11p10, where Autodiscover/Autodiscover.xml processing is vulnerable to XML External Entity (XXE) injection. The root cause is XXE-safe processing not being enforced during XML parsing, enabling an attacker to retriev...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

PT-2019-18394

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Suite versions 8.7.x through 8.8.11 Description The issue concerns insecure object deserialization in the IMAP component. Recommendations For versions 8.7.x through 8.8.11, update to a version that includes a fix f...

PT-2019-9612

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6, 8.7 through 8.7.11 Patch 6, and 8.8 through 8.8.10 Patch 1 Description The issue is related to a Persistent XSS in the mailboxd component. Recommendations For versions 8.6, update to version 8.7.11 Patc...

Zimbra Collaboration Suite mailboxd Component Cross-Site Scripting Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from the American company Zimbra. The product includes WebMail, calendar, address book , etc. mailboxd is one of the e-mail component . A cross-site scripting vulnerability exists in the mailboxd component in Zimbra ZCS versions...

PT-2019-18395

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.7.x through 8.8.11 Description The issue allows for Blind Server-Side Request Forgery SSRF in the Feed component. Recommendations For Zimbra Collaboration Suite versions 8.7.x through 8.8.11, update to a...

CVE-2018-18631: Improper Neutralization of Input During Web Page Generation

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2018-14013: Improper Neutralization of Input During Web Page Generation

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...

CVE-2019-6981: Server-Side Request Forgery (SSRF)

Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...

CVE-2018-20160: Improper Restriction of XML External Entity Reference

ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...

CVE-2019-6980: Deserialization of Untrusted Data

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...

CVE-2019-9670: Improper Restriction of XML External Entity Reference

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

PT-2019-9018

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Suite Collaboration versions prior to 8.8.11 Description The issue concerns an XSS in the AJAX and html web clients. Recommendations For versions prior to 8.8.11, update to version 8.8.11 or later to resolve the...

xss vulnerability exists in Xinhoo Collaboration Office v1.9.1

Xinhuo Co-operation Office System is an open source and cross-platform office system. A xss vulnerability exists in Xinhao Collaboration Office v1.9.1, which can be exploited by attackers to obtain an administrator cookie...

Build Bikes and Go Fast: Why Building Bikes is Critical to Imperva’s Success

In May 2019, seventy members of Imperva’s global leadership team gathered in one location to share insights, to develop and commit to our future strategy, and to build bikes. That’s right, to build bikes. Of course, that bit about developing and committing to our future strategy is undeniably...

UK launches cyberstrategy with long-term relevance

Like most major global economies, the United Kingdom continues to place cybersecurity issues front and center. The National Cyber Security Strategy: 2016-2021 document—published by the UK Government and released nearly two years ago—describes the plan to make the UK secure and resilient in...

Cisco Prime Collaboration Assurance Code Execution

The vulnerability in the web interface of the Cisco Prime Collaboration Assurance management software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser or gain...

Nine Charged in Alleged SIM Swapping Ring

Eight Americans and an Irishman have been charged with wire fraud this week for allegedly hijacking mobile phones through SIM-swapping, a form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target's phone number and diverting all texts and...