CVE Vulnerability Advisory Database

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Systems running macOS Sequoia prior to 15.1.1, iOS/iPadOS prior to 18.1.1 and 17.7.2, and Safari prior to 18.1.1

[Impact] Processing maliciously crafted web content can trigger a Cross-Site Scripting (XSS) attack due to state management flaws, with active exploitation reported on Intel-based Mac systems

[Mitigation] Immediately apply the official software updates provided by Apple for macOS, iOS, iPadOS, and Safari

[Affected Scope] MDaemon Email Server versions prior to 24.5.1c with Webmail enabled

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of a victim's browser session by sending a specially crafted HTML email, potentially leading to session hijacking and credential theft

[Mitigation] Immediately upgrade MDaemon Email Server to version 24.5.1c or later to resolve the sanitization flaw

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0 utilizing the classic webmail user interface.

[Impact] Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking and unauthorized data access.

[Mitigation] Apply official security patches (9.0.0 Patch 39, 10.0.7 or higher) immediately, or restrict access to the classic UI.

[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7

[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).

[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)

[Affected Scope] Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted text/plain email, potentially leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.4.14, 1.5.4, 1.6.3, or later) and enforce strict Content Security Policies

[Affected Scope] Zimbra Collaboration Suite (ZCS) 8.8.15 versions prior to Patch 41 utilizing the Classic Web Client

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, and unauthorized access to mailboxes

[Mitigation] Apply the official Zimbra security patch (8.8.15 Patch 41 or higher) immediately, or implement WAF rules to block malicious query parameters

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] HelpSystems Cobalt Strike through version 4.7 (specifically affecting the Teamserver component)

[Impact] A remote attacker can execute arbitrary HTML/JS code within the Cobalt Strike operator console by spoofing the username field in a beacon payload, potentially leading to session hijacking or information disclosure

[Mitigation] Immediately upgrade Cobalt Strike to the official patched version 4.7.1 or higher

[Affected Scope] Zimbra Collaboration Suite (ZCS) 9.0.0 versions prior to Patch 24

[Impact] Unauthenticated attackers can execute arbitrary web scripts or HTML in the victim's browser session, potentially hijacking active sessions and accessing sensitive mailboxes

[Mitigation] Immediately upgrade to Zimbra 9.0.0 Patch 24 or later, and apply temporary WAF rules to block access to the vulnerable endpoint

[Affected Scope] Zimbra Collaboration Suite (ZCS) 8.8.x versions prior to 8.8.15 Patch 30 (Update 1)

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking and unauthorized mailbox access

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 30 (Update 1) or later

[Affected Scope] Roundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] Cisco ASA and FTD Software with AnyConnect or WebVPN configurations enabled

[Impact] Unauthenticated remote attackers can execute arbitrary script code in the user's browser context, potentially compromising session tokens and sensitive data

[Mitigation] Apply official Cisco software updates immediately and restrict access to the web services interface

[Affected Scope] Roundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later