CVE Vulnerability Advisory Database

[Affected Scope] Zimbra Collaboration Suite (ZCS) 8.8.15 versions prior to Patch 41 utilizing the Classic Web Client

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, and unauthorized access to mailboxes

[Mitigation] Apply the official Zimbra security patch (8.8.15 Patch 41 or higher) immediately, or implement WAF rules to block malicious query parameters

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] jQuery versions greater than or equal to 1.0.3 and before 3.5.0

[Impact] Passing untrusted HTML to jQuery's DOM manipulation methods (e.g., .html(), .append()) can execute arbitrary JavaScript code even after sanitization

[Mitigation] Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function

[Affected Scope] WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10

[Impact] Cross-site scripting (XSS) and local file reading, potentially leading to remote code execution (RCE) and sensitive data exfiltration upon user interaction

[Mitigation] Immediately update WhatsApp Desktop to version 0.3.9309 or higher and WhatsApp for iPhone to version 2.20.10 or higher

[Affected Scope] D-Link DSL-2760U Gateway (Rev. E1) hardware and firmware.

[Impact] Remote authenticated attackers can inject arbitrary web script or HTML via multiple parameters, leading to administrator session hijacking and device compromise.

[Mitigation] Apply the latest official firmware patches, disable external WAN management interfaces, and restrict access to trusted IP ranges.

[Affected Scope] Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, macOS, Linux, and Solaris; Android 2.x/3.x/4.x mobile versions

[Impact] Remote attackers can bypass the Same-Origin Policy (SOP) via malicious Flash content, executing arbitrary scripts in the context of any website visited by the user to steal sessions and sensitive data

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it must be completely uninstalled from all systems, or disabled at the browser level in legacy environments