Vulnerabilidades exploradas (CISA KEV)

CVE-2026-73570 Alta · 8.9 KEV Alta · 66 Exploit público CWE-78 13/08/2026

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CVE-2025-66376 Média · 6.1 KEV Alta · 53 CWE-79 05/01/2026

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

CVE-2025-68645 Alta · 8.8 KEV Alta · 66 Exploit público CWE-98 22/12/2025

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

CVE-2025-48700 Média · 6.1 KEV Alta · 50 CWE-79 23/06/2025

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

CVE-2025-27915 Média · 5.4 KEV Alta · 56 Exploit público CWE-79 12/03/2025

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

CVE-2024-45519 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-78 02/10/2024

Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

CVE-2023-37580 Média · 6.1 KEV Alta · 57 Exploit público CWE-79 31/07/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CVE-2023-34192 Crítica · 9.0 KEV Alta · 64 Exploit público CWE-79 06/07/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

CVE-2022-41352 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 25/09/2022

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

CVE-2022-37042 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 12/08/2022

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

CVE-2022-27924 Alta · 7.5 KEV Urgente · 73 Exploit público Ransomware CWE-74 20/04/2022

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

CVE-2022-27925 Alta · 7.2 KEV Urgente · 89 Exploit público Ransomware CWE-22 20/04/2022

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

CVE-2022-27926 Média · 6.1 KEV Alta · 57 Exploit público CWE-79 20/04/2022

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

CVE-2022-24682 Média · 6.1 KEV Alta · 67 Exploit público Ransomware CWE-116 09/02/2022

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

CVE-2020-7796 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-918 18/02/2020

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CVE-2019-9670 Crítica · 9.8 KEV Urgente · 93 Exploit público CWE-611 29/05/2019

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

CVE-2019-9621 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-918 30/04/2019

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

CVE-2018-6882 Média · 6.1 KEV Alta · 67 Exploit público Ransomware CWE-79 27/03/2018

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.