Zimbra Collaboration Suite

zimbra_collaboration_suite

Vendor: Synacor • 82 CVEs

CVEs (82)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-14425 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVE-2018-10948 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2018-15131 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible v...Show more An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.Show less
CVE-2019-9670 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-6981 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVE-2019-6980 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVE-2018-20160 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
CVE-2018-18631 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVE-2018-14013 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVE-2019-9621 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Apr 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE-2018-17938 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 Oct 3, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVE-2018-10939 2Synacor Zimbra 2Zimbra Collaboration Suite Zimbra Collaboration Suite Nov 21, 2024 May 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVE-2015-7610 2Synacor Zimbra 2Zimbra Collaboration Suite Zimbra Collaboration Suite Nov 21, 2024 May 30, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hija...Show more Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.Show less
CVE-2018-10951 1Synacor 1Zimbra Collaboration Suite Aug 15, 2025 May 10, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Ad...Show more mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.Show less
CVE-2018-10950 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 10, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full us...Show more mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump.Show less
CVE-2018-10949 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 10, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authen...Show more mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.Show less
CVE-2018-6882 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Mar 27, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary...Show more Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.Show less
CVE-2017-8783 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 Feb 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS.
CVE-2017-17703 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 Feb 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.
CVE-2017-7288 1Synacor 1Zimbra Collaboration Suite May 13, 2026 May 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Previous 1 234 5 Next