Zimbra Collaboration (ZCS)
by Zimbra
CVEs (120)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-43102 | Med | 0.40 | 6.1 | 0.00 | Dec 7, 2023 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36. | ||
| CVE-2023-24031 | Med | 0.40 | 6.1 | 0.00 | Jun 15, 2023 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure. | ||
| CVE-2023-24030 | Med | 0.40 | 6.1 | 0.00 | Jun 15, 2023 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker… | ||
| CVE-2022-45913 | Med | 0.40 | 6.1 | 0.00 | Jan 6, 2023 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure. | ||
| CVE-2022-45911 | Med | 0.40 | 6.1 | 0.00 | Jan 6, 2023 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary… | ||
| CVE-2022-41351 | Med | 0.40 | 6.1 | 0.00 | Oct 12, 2022 | In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10). | ||
| CVE-2022-41350 | Med | 0.40 | 6.1 | 0.00 | Oct 12, 2022 | In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine. | ||
| CVE-2022-41348 | Med | 0.40 | 6.1 | 0.00 | Oct 12, 2022 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure. | ||
| CVE-2022-37044 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2022 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine. | ||
| CVE-2020-18985 | Med | 0.40 | 6.1 | 0.01 | Dec 15, 2021 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. | ||
| CVE-2020-18984 | Med | 0.40 | 6.1 | 0.01 | Dec 15, 2021 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection. | ||
| CVE-2021-35207 | Med | 0.40 | 6.1 | 0.03 | Jul 2, 2021 | An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the… | ||
| CVE-2021-34807 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2021 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could… | ||
| CVE-2020-13653 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2020 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail… | ||
| CVE-2019-8946 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | ||
| CVE-2019-8945 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | ||
| CVE-2019-15313 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | ||
| CVE-2018-18631 | Med | 0.40 | 6.1 | 0.01 | May 29, 2019 | mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS. | ||
| CVE-2018-10939 | Med | 0.40 | 6.1 | 0.01 | May 30, 2018 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. | ||
| CVE-2017-17703 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2018 | Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS. |
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.
- risk 0.40cvss 6.1epss 0.00
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker…
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary…
- risk 0.40cvss 6.1epss 0.00
In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10).
- risk 0.40cvss 6.1epss 0.00
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure.
- risk 0.40cvss 6.1epss 0.01
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
- risk 0.40cvss 6.1epss 0.01
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.
- risk 0.40cvss 6.1epss 0.03
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the…
- risk 0.40cvss 6.1epss 0.01
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could…
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail…
- risk 0.40cvss 6.1epss 0.01
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- risk 0.40cvss 6.1epss 0.01
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- risk 0.40cvss 6.1epss 0.01
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
- risk 0.40cvss 6.1epss 0.01
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
- risk 0.40cvss 6.1epss 0.01
Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.
Page 4 of 6