Synacor

synacor

94 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Zimbra Collaboration Suite

zimbra_collaboration_suite

89 CVEs

Zimbra Collaboration Server

zimbra_collaboration_server

5 CVEs

CVEs (94)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-18985 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Dec 15, 2021 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
CVE-2020-18984 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Dec 15, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a ho...Show more A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.Show less
CVE-2020-13653 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Jul 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected cod...Show more An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.Show less
CVE-2020-12846 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Jun 3, 2020 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files...Show more Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.Show less
CVE-2020-8633 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Feb 18, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
CVE-2020-7796 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 Feb 18, 2020 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2019-11318 1Synacor 1Zimbra Collaboration Server Jun 17, 2026 Jan 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
CVE-2015-2249 1Synacor 1Zimbra Collaboration Server Nov 21, 2024 Jan 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Zimbra Collaboration before 8.6.0 patch5 has XSS.
CVE-2014-8563 1Synacor 1Zimbra Collaboration Server Nov 21, 2024 Jan 27, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
CVE-2014-5500 1Synacor 1Zimbra Collaboration Server Nov 21, 2024 Jan 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration before 8.0.8 has XSS.
CVE-2015-7609 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
CVE-2015-2230 1Synacor 1Zimbra Collaboration Server Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
CVE-2018-14425 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVE-2018-10948 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2018-15131 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible v...Show more An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.Show less
CVE-2019-9670 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-6981 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVE-2019-6980 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVE-2018-20160 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
CVE-2018-18631 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.

Previous 1 234 5 Next