Vulnerabilities > Zimbra

DATE CVE VULNERABILITY TITLE RISK
2022-04-21 CVE-2022-27924 Injection vulnerability in Zimbra Collaboration 8.8.15/9.0.0
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance.
network
low complexity
zimbra CWE-74
5.0
2022-04-21 CVE-2022-27925 Unrestricted Upload of File with Dangerous Type vulnerability in Zimbra Collaboration 8.8.15/9.0.0
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
network
low complexity
zimbra CWE-434
6.5
2022-04-21 CVE-2022-27926 Cross-site Scripting vulnerability in Zimbra Collaboration 9.0.0
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
network
zimbra CWE-79
4.3
2022-02-09 CVE-2022-24682 Cross-site Scripting vulnerability in Zimbra Collaboration
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021.
network
zimbra CWE-79
4.3
2021-07-02 CVE-2021-34807 Open Redirect vulnerability in Zimbra Collaboration
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0.
network
zimbra CWE-601
5.8
2021-07-02 CVE-2021-35207 Cross-site Scripting vulnerability in Zimbra Collaboration
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16.
network
zimbra CWE-79
4.3
2021-07-02 CVE-2021-35208 Cross-site Scripting vulnerability in Zimbra Collaboration
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23.
network
zimbra CWE-79
3.5
2021-07-02 CVE-2021-35209 Server-Side Request Forgery (SSRF) vulnerability in Zimbra Collaboration
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16.
network
low complexity
zimbra CWE-918
7.5
2020-12-17 CVE-2020-35123 XXE vulnerability in Zimbra Collaboration 8.8.15/9.0.0
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks.
network
low complexity
zimbra CWE-611
4.0
2020-05-05 CVE-2020-11737 Cross-site Scripting vulnerability in Zimbra 9.0.0
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript.
network
zimbra CWE-79
4.3