CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail Stored Cross-Site Scripting (XSS) Vulnerability Leading to Email Theft Advisory (CVE-2024-42009)
[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7
[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).
Zimbra Collaboration Suite (ZCS) 8.8.15 Stored XSS Vulnerability Leading to Remote Code Execution (CVE-2023-34192) Security Advisory
[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15
[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function
[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules