Darren Martyn

**Name of the Vulnerable Software and Affected Versions** MXsecurity versions prior to v1.0.1 **Description** The issue is related to the use of a hard-coded SSH host key in the MXsecurity platform, which may facilitate man-in-the-middle attacks and enable the decryption of SSH traffic. This could put the confidentiality and integrity of SSH communications at risk on the affected device. **Recommendations** For MXsecurity versions prior to v1.0.1, update to version v1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting SSH access to minimize the risk of exploitation. Avoid using the hard-coded SSH host key in the affected device until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zimbra Collaboration Suite (affected versions not specified) **Description** The issue is related to the sudo configuration in Zimbra, which allows the zimbra user to execute the zmslapd binary as root with arbitrary parameters. The zmslapd binary can load a user-defined configuration file that includes plugins in the form of .so files, which execute as root. This is associated with inadequate access control in the zmslapd function of the Zimbra Collaboration Suite, potentially allowing an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM version 7.2.2 **Description** The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension due to an incomplete blacklist vulnerability. **Recommendations** For SuiteCRM version 7.2.2, update to a version that includes a comprehensive blacklist to prevent the upload of files with executable extensions.