← Back

Synacor

synacor

87 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Zimbra Collaboration Suite
zimbra_collaboration_suite
82 CVEs
Zimbra Collaboration Server
zimbra_collaboration_server
5 CVEs

CVEs (87)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-2249
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
Jan 27, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Zimbra Collaboration before 8.6.0 patch5 has XSS.
CVE-2014-8563
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
Jan 27, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
CVE-2014-5500
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Collaboration before 8.0.8 has XSS.
CVE-2015-7609
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
CVE-2015-2230
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
May 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
CVE-2018-14425
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVE-2018-10948
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2018-15131
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible v...Show more
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.Show less
CVE-2019-9670
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-6981
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVE-2019-6980
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVE-2018-20160
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
CVE-2018-18631
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVE-2018-14013
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVE-2019-9621
1Synacor
1Zimbra Collaboration Suite
Jun 17, 2026
Apr 30, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE-2018-17938
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
Oct 3, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVE-2018-10939
2Synacor
Zimbra
2Zimbra Collaboration Suite
Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVE-2015-7610
2Synacor
Zimbra
2Zimbra Collaboration Suite
Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hija...Show more
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.Show less
CVE-2018-10951
1Synacor
1Zimbra Collaboration Suite
Aug 15, 2025
May 10, 2018
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Ad...Show more
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.Show less
CVE-2018-10950
1Synacor
1Zimbra Collaboration Suite
Nov 21, 2024
May 10, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full us...Show more
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump.Show less