CVE Watch7 ago 2026

CVE-2022-24682

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

CVSS

6.1

Medio

EPSS

30.9%

p98

KEV

SÍ

25 feb 2022

Exploit Today

0-100

Publicado: 9 feb 2022 · Última mod.: 7 ago 2026 · CWE-116

EPSS · 30d

30.9%EPSS · 30 días31.1%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

Synacor / Zimbra Collaborate Suite (ZCS)

Vulnerabilidad

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Añadido a KEV

25 feb 2022

Remediar antes de

11 mar 2022

Uso conocido en ransomware

Sí

Descripción resumida

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2022-24682

Descripción técnica

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-82681—

18.6%

——6Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values. This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.13h CVE-2026-822493.1 BAJ

6.2%

——2gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.3d CVE-2026-815228.1 ALT

18.1%

——5A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.3d CVE-2026-816853.3 BAJ

7.3%

——2openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.3d CVE-2026-650855.2 MED

1.9%

——1NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering.3d CVE-2026-556186.5 MED

22.1%

——7eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found_uri function in eml_parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. Valid encoded URLs and their host names are therefore rejected and omitted from the extracted URL and domain lists. Email security gateways and SOC pipelines that use those lists as indicators of compromise may fail to submit the hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. This issue is fixed in version 3.0.2.3d