Vulnerabilidades do Zimbra Collaboration
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Zimbra Collaboration: 5 registro(s), com versões afetadas e correções.
CVE-2026-73570
Alta · 8.9
KEV Alta · 66 Exploit público CWE-78 13/08/2026
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CVE-2025-66376
Média · 6.1
KEV Alta · 53 CWE-79 05/01/2026
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-67809
Média · 4.7
CWE-798 15/12/2025
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key...
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user s Flickr data. The hardcoded credentials have since been removed from the Zimlet code, and the associated key has been revoked.
CVE-2025-62763
Média · 5.0
CWE-918 21/10/2025
Server-Side Request Forgery (SSRF) em Zimbra Collaboration
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
CVE-2024-27443
Média · 6.1
KEV Alta · 57 Exploit público CWE-79 12/08/2024
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.