U.S. CISA adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-38950 | Unauthenticated Path Traversal in ZKTeco BioTime iclock API (Arbitrary File Read) | 7.5 | 92% | KEVPoC | KEV |
| CVE-2024-11182 | Unauthenticated Cross-Site Scripting (XSS) in MDaemon Email Server Webmail | 5.3 | 33% | KEV | KEV |
| CVE-2024-27443 | Cross-Site Scripting in Zimbra Collaboration Suite CalendarInvite (Classic Webmail) | 6.1 | 25% | KEV | KEV |
| CVE-2025-27920 | Directory Traversal in Srimax Output Messenger Before 2.0.63 | 8.8 | 2% | KEV | KEV |
CVE-2025-4428+1 related CVE | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API | 8.8 group max | 88% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.