CVE Intelligence

Synacor Zimbra Collaboration Suite vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Synacor Zimbra Collaboration Suite: 30 record(s), with affected versions and fixes.
cpe:2.3:a:synacor:zimbra_collaboration_suite

CVE-2022-24682 Medium · 6.1 KEV High · 67 Public exploit Ransomware CWE-116 Feb 9, 2022
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CVE-2020-7796 Critical · 9.8 KEV High · 67 Public exploit CWE-918 Feb 18, 2020
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2019-9670 Critical · 9.8 KEV Urgent · 93 Public exploit CWE-611 May 29, 2019
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-9621 High · 7.5 KEV Urgent · 79 Public exploit CWE-918 Apr 30, 2019
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE-2018-6882 Medium · 6.1 KEV High · 67 Public exploit Ransomware CWE-79 Mar 27, 2018
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.