InfoSecBulletin Cybersecurity for mankind
Zimbra launched version 10.1.16 addressing serious vulnerabilities like cross-site scripting (XSS), XML external entity (XXE), and LDAP injection. This urgent update, marked as high risk for patch severity and deployment, requires admins to upgrade right away to protect against exploits.
Attackers can use unsanitized inputs to insert harmful scripts, which could steal user sessions or data.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
| Vulnerability | CVE Status | Impact | Fix Summary |
|---|---|---|---|
| XSS in Webmail/Briefcase | Pending | Session hijacking, data theft | Improved input validation & encoding |
| XXE in EWS SOAP | Pending | File disclosure, DoS, SSRF | Disabled external entity processing |
| LDAP Injection | Pending | Privilege escalation, data leak | Strengthened query sanitization |
Zimbra 10.1.16 improves Backup & Restore with 50% faster performance and 45% less storage through Zstandard compression and deduplication for S3.
Modern Web App adds email translation (Chrome only), smarter search, custom tag colors, and Zoom integration. Ubuntu 24 beta support is also available, but it’s not suitable for production.
More than 20 bug fixes for ActiveSync, EWS, Chat, and Zimbra Desktop enhance stability, with detailed release notes and admin guides available.
This patch highlights the importance of quick updates in cybersecurity. Delayed patches can lead to breaches, while Zimbra’s fast action is a good example.
