Vulnerabilities > Synacor

DATE CVE VULNERABILITY TITLE RISK
2020-01-27 CVE-2014-5500 Cross-site Scripting vulnerability in Synacor Zimbra Collaboration Server
Synacor Zimbra Collaboration before 8.0.8 has XSS.
network
synacor CWE-79
4.3
2019-05-30 CVE-2015-7609 Cross-site Scripting vulnerability in Synacor Zimbra Collaboration Suite 8.6.0
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
network
synacor CWE-79
4.3
2019-05-30 CVE-2015-2230 Cross-site Scripting vulnerability in Synacor Zimbra Collaboration Server
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
network
synacor CWE-79
4.3
2019-05-30 CVE-2018-14425 Cross-site Scripting vulnerability in Synacor Zimbra Collaboration Suite
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
network
synacor CWE-79
4.3
2019-05-30 CVE-2018-10948 Cross-site Scripting vulnerability in Synacor Zimbra Collaboration Suite
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
network
synacor CWE-79
3.5
2019-05-30 CVE-2018-15131 Information Exposure vulnerability in Synacor Zimbra Collaboration Suite
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3.
network
low complexity
synacor CWE-200
5.0
2019-05-29 CVE-2019-9670 XXE vulnerability in Synacor Zimbra Collaboration Suite
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
network
low complexity
synacor CWE-611
7.5
2019-05-29 CVE-2019-6981 Server-Side Request Forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
network
low complexity
synacor CWE-918
4.0
2019-05-29 CVE-2019-6980 Deserialization of Untrusted Data vulnerability in Synacor Zimbra Collaboration Suite
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
network
low complexity
synacor CWE-502
7.5
2019-05-29 CVE-2018-20160 XXE vulnerability in Synacor Zimbra Collaboration Suite
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
network
low complexity
synacor CWE-611
7.5