CVE Vulnerability Advisory Database

[Affected Scope] All Cisco Secure Email Gateway appliances running vulnerable versions of Cisco AsyncOS Software.

[Impact] An unauthenticated remote attacker can execute arbitrary commands with root privileges by sending a crafted email, leading to full system compromise.

[Mitigation] Immediately apply the official security patches provided by Cisco and monitor for signs of exploitation.

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).

[Affected Scope] Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted text/plain email, potentially leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.4.14, 1.5.4, 1.6.3, or later) and enforce strict Content Security Policies

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions prior to 8.7 Patch 1 and 8.8.x versions prior to 8.8.7

[Impact] Remote attackers can execute arbitrary web script or HTML in the victim's browser context via a manipulated Content-Location header in an email attachment, leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the latest patched version (8.7 Patch 1, 8.8.7, or later)