CVE Vulnerability Advisory Database

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Roundcube versions before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted HTML email containing a malicious SVG document

[Mitigation] Immediately upgrade Roundcube to the patched versions (1.4.15, 1.5.5, or 1.6.4 and above)

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Attackers can inject malicious scripts permanently via system_settings.shtm, leading to administrator session hijacking and unauthorized SCADA control

[Mitigation] Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters

[Affected Scope] WordPress Social Warfare and Social Warfare Pro plugins prior to version 3.5.3

[Impact] Unauthenticated attackers can inject malicious scripts, leading to administrative privilege takeover and Remote Code Execution (RCE)

[Mitigation] Immediately update the Social Warfare plugin to version 3.5.3 or higher, and block unauthorized debug parameter requests