CVE Vulnerability Advisory Database

[Affected Scope] Ad Inserter WordPress plugin versions 2.8.19 and below

[Impact] Unauthenticated remote attackers can inject malicious scripts to hijack admin sessions, deface websites, or conduct phishing attacks

[Mitigation] Immediately update the plugin to version 2.8.20 or later

[Affected Scope] Netsweeper versions prior to 4.0.11 and 4.1.0 through 4.1.4.

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser, potentially leading to administrative session hijacking.

[Mitigation] Immediately upgrade Netsweeper to version 4.0.11, 4.1.5, or later.

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules