← Back

Zimbra Collaboration Suite

zimbra_collaboration_suite

Vendor: Synacor • 89 CVEs

CVEs (89)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-18985
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Dec 15, 2021
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
CVE-2020-18984
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Dec 15, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a ho...Show more
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.Show less
CVE-2020-13653
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Jul 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected cod...Show more
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.Show less
CVE-2020-12846
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Jun 3, 2020
N/A· v4
8.0 HIGH· v3
6.0 MEDIUM· v2
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files...Show more
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.Show less
CVE-2020-8633
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Feb 18, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
CVE-2020-7796
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Feb 18, 2020
N/A· v4
9.8 CRITICAL· v3
6.8 MEDIUM· v2
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2015-7609
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
CVE-2018-14425
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVE-2018-10948
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2018-15131
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible v...Show more
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.Show less
CVE-2019-9670
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-6981
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVE-2019-6980
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVE-2018-20160
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
CVE-2018-18631
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVE-2018-14013
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVE-2019-9621
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Apr 30, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE-2018-17938
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
Oct 3, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVE-2018-10939
2Synacor
Zimbra
2Zimbra Collaboration Suite
Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVE-2015-7610
2Synacor
Zimbra
2Zimbra Collaboration Suite
Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hija...Show more
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.Show less