InfoSecBulletin Cybersecurity for mankind
Zimbra launched version 10.1.16 addressing serious vulnerabilities like cross-site scripting (XSS), XML external entity (XXE), and LDAP injection. This urgent update, marked as high risk for patch severity and deployment, requires admins to upgrade right away to protect against exploits.
Attackers can use unsanitized inputs to insert harmful scripts, which could steal user sessions or data.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
| Vulnerability | CVE Status | Impact | Fix Summary |
|---|---|---|---|
| XSS in Webmail/Briefcase | Pending | Session hijacking, data theft | Improved input validation & encoding |
| XXE in EWS SOAP | Pending | File disclosure, DoS, SSRF | Disabled external entity processing |
| LDAP Injection | Pending | Privilege escalation, data leak | Strengthened query sanitization |
Zimbra 10.1.16 improves Backup & Restore with 50% faster performance and 45% less storage through Zstandard compression and deduplication for S3.
Modern Web App adds email translation (Chrome only), smarter search, custom tag colors, and Zoom integration. Ubuntu 24 beta support is also available, but it’s not suitable for production.
More than 20 bug fixes for ActiveSync, EWS, Chat, and Zimbra Desktop enhance stability, with detailed release notes and admin guides available.
This patch highlights the importance of quick updates in cybersecurity. Delayed patches can lead to breaches, while Zimbra’s fast action is a good example.
