pwn.watch: XSS incident updates https://pwn.watch/t/xss Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 26 Oct 2023 00:00:00 GMT [medium] Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631) https://pwn.watch/i/roundcube-webmail-cve-2023-5631 https://pwn.watch/i/roundcube-webmail-cve-2023-5631 Thu, 26 Oct 2023 00:00:00 GMT medium <p>Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. Added to CISA KEV on 2023-10-26.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-10-26: CISA added CVE-2023-5631 to the KEV catalog (due 2023-11-16).</li></ul> <p><strong>CVEs:</strong> CVE-2023-5631</p> [medium] Synacor Zimbra Collaboration Suite (ZCS): Cross-Site Scripting (XSS) (CVE-2023-37580) https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-37580 https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-37580 Thu, 27 Jul 2023 00:00:00 GMT medium <p>Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. Added to CISA KEV on 2023-07-27.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-07-27: CISA added CVE-2023-37580 to the KEV catalog (due 2023-08-17).</li></ul> <p><strong>CVEs:</strong> CVE-2023-37580</p> [medium] Synacor Zimbra Collaboration Suite (ZCS): Cross-Site Scripting (XSS) (CVE-2022-27926) https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27926 https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27926 Mon, 03 Apr 2023 00:00:00 GMT medium <p>Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. Added to CISA KEV on 2023-04-03.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-04-03: CISA added CVE-2022-27926 to the KEV catalog (due 2023-04-24).</li></ul> <p><strong>CVEs:</strong> CVE-2022-27926</p> [critical] Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948) https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948 https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948 Thu, 30 Mar 2023 00:00:00 GMT critical <p>Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-03-30: CISA added CVE-2022-39197 to the KEV catalog (due 2023-04-20).</li><li>2023-03-30: CISA added CVE-2022-42948 to the KEV catalog (due 2023-04-20).</li></ul> <p><strong>CVEs:</strong> CVE-2022-39197, CVE-2022-42948</p>