Zimbra urges customers to patch critical web client XSS flaw

Zimbra released ZCS v10.1.19 to patch a critical stored XSS vulnerability in its Classic Web Client that can be triggered by specially crafted emails to steal session data, account settings, or mailbox content; the flaw was reported by Google's Threat Analysis Group and, while not yet confirmed as exploited in the wild, is highlighted as high-risk given prior widespread abuse of Zimbra vulnerabilities by Russian state-linked APTs.