Oct 7, 2025
1 new incident, 1 with updates.
Started
- ClosedPatched
Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. Added to CISA KEV on 2025-10-07.
Synacor Zimbra Collaboration Suite (ZCS)Closed Oct 7, 2025
Updated
- ClosedHighNo fix needed
Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)
A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.
Asahi Group Holdings (Japan operations)Closed Oct 15, 2025
