5045 matches found
CVE-2023-45207
CVE-2023-45207 concerns Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, and 10.0. An attacker could send a PDF with embedded JavaScript via email; when the PDF is previewed in webmail (Chrome), a stored XSS payload may execute. Documents consistently state that this has been mitigated by s...
CVE-2023-48432: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link for a webmail redirection endpoint within en email message, e.g., if a victim clicks on that link within Zimbra webmail...
CVE-2023-45206
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...
CVE-2023-48432
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link for a webmail redirection endpoint within en email message, e.g., if a victim clicks on that link within Zimbra webmail...
CVE-2023-45207
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. This has been mitigated by sanitising th...
CVE-2023-45206: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...
PT-2024-13227 · Zimbra · Zimbra Collaboration
Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 10.0 Description: An issue was discovered in Zimbra Collaboration, where an attacker can inject JavaScript or HTML code through the help document endpoint in webmail, leading to cross-site...
CVE-2023-45207
An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. This has been mitigated by sanitising th...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-43770link is external Roundcube Webmail Persistent Cross-Site Scripting XSS Vulnerability These types of vulnerabilities are frequent attack vectors for maliciou...
VulnCheck KEV: CVE-2023-43770
Roundcube Webmail contains a persistent cross-site scripting XSS vulnerability that can lead to information disclosure via malicious link references in plain/text messages...
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube Webmail contains a persistent cross-site scripting XSS vulnerability that can lead to information disclosure via malicious link references in plain/text messages...
CVE-2023-48974
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
CVE-2023-48974
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
Cross site scripting
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
CVE-2023-48974
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
CVE-2023-48974: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
CVE-2023-48974
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverNameinput parameter...
Axigen Cross-Site Scripting Vulnerability
Axigen is a mail server with groupware and collaboration features from Axigen. A cross-site scripting vulnerability exists in Axigen WebMail version v.10.5.7 and earlier. A remote attacker can exploit this vulnerability to escalate privileges via specially crafted scripts...
CVE-2023-48974
Axigen WebMail is affected by a Cross-Site Scripting vulnerability (CVE-2023-48974) in versions prior to 10.3.3.61. The issue allows a remote attacker to escalate privileges by injecting a crafted script via the serverName_input parameter. Public exploit activity exists (e.g., Exploit-DB) and mai...
PT-2024-13666 · Axigen · Axigen Webmail
Name of the Vulnerable Software and Affected Versions: Axigen WebMail versions prior to 10.3.3.61 Description: The issue allows a remote attacker to escalate privileges via a crafted script to the serverName input parameter. This is a Cross Site Scripting vulnerability. Recommendations: For...