CVE Vulnerability Advisory Database

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).

[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Systems running macOS Sequoia prior to 15.1.1, iOS/iPadOS prior to 18.1.1 and 17.7.2, and Safari prior to 18.1.1

[Impact] Processing maliciously crafted web content can trigger a Cross-Site Scripting (XSS) attack due to state management flaws, with active exploitation reported on Intel-based Mac systems

[Mitigation] Immediately apply the official software updates provided by Apple for macOS, iOS, iPadOS, and Safari

[Affected Scope] MDaemon Email Server versions prior to 24.5.1c with Webmail enabled

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of a victim's browser session by sending a specially crafted HTML email, potentially leading to session hijacking and credential theft

[Mitigation] Immediately upgrade MDaemon Email Server to version 24.5.1c or later to resolve the sanitization flaw

[Affected Scope] All supported versions of Windows client and server operating systems utilizing the MSHTML (Internet Explorer) engine.

[Impact] Attackers can bypass security warnings and spoof trusted domains to steal sensitive credentials or execute malicious payloads by tricking users into visiting crafted web content.

[Mitigation] Immediately apply the October 2024 Microsoft cumulative security updates and restrict MSHTML execution via registry hardening.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0 utilizing the classic webmail user interface.

[Impact] Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking and unauthorized data access.

[Mitigation] Apply official security patches (9.0.0 Patch 39, 10.0.7 or higher) immediately, or restrict access to the classic UI.

[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7

[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).

[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)

[Affected Scope] Roundcube versions before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted HTML email containing a malicious SVG document

[Mitigation] Immediately upgrade Roundcube to the patched versions (1.4.15, 1.5.5, or 1.6.4 and above)

[Affected Scope] Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted text/plain email, potentially leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.4.14, 1.5.4, 1.6.3, or later) and enforce strict Content Security Policies

[Affected Scope] Zimbra Collaboration Suite (ZCS) 8.8.15 versions prior to Patch 41 utilizing the Classic Web Client

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, and unauthorized access to mailboxes

[Mitigation] Apply the official Zimbra security patch (8.8.15 Patch 41 or higher) immediately, or implement WAF rules to block malicious query parameters

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] HelpSystems Cobalt Strike through version 4.7 (specifically affecting the Teamserver component)

[Impact] A remote attacker can execute arbitrary HTML/JS code within the Cobalt Strike operator console by spoofing the username field in a beacon payload, potentially leading to session hijacking or information disclosure

[Mitigation] Immediately upgrade Cobalt Strike to the official patched version 4.7.1 or higher

[Affected Scope] Zimbra Collaboration Suite (ZCS) 9.0.0 versions prior to Patch 24

[Impact] Unauthenticated attackers can execute arbitrary web scripts or HTML in the victim's browser session, potentially hijacking active sessions and accessing sensitive mailboxes

[Mitigation] Immediately upgrade to Zimbra 9.0.0 Patch 24 or later, and apply temporary WAF rules to block access to the vulnerable endpoint

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Attackers can inject malicious scripts permanently via system_settings.shtm, leading to administrator session hijacking and unauthorized SCADA control

[Mitigation] Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters

[Affected Scope] Apple devices running iOS versions prior to 12.5.2, iOS versions prior to 14.4.2, iPadOS versions prior to 14.4.2, and watchOS versions prior to 7.3.3

[Impact] Processing maliciously crafted web content can bypass the Same-Origin Policy (SOP), leading to Universal Cross-Site Scripting (UXSS) and arbitrary script execution, which has been actively exploited in the wild

[Mitigation] Immediately update affected devices to the patched versions: iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, watchOS 7.3.3, or later

[Affected Scope] Roundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher