CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail Stored Cross-Site Scripting (XSS) Vulnerability Leading to Email Theft Advisory (CVE-2024-42009)
[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7
[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).
Zimbra Collaboration Suite (ZCS) 8.8.15 Stored XSS Vulnerability Leading to Remote Code Execution (CVE-2023-34192) Security Advisory
[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15
[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function
[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules
Crestron, Barco, Extron Wireless Presentation Systems Remote Code Execution Vulnerability (CVE-2019-3929)
[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.
[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.
[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.