synacor zimbra collaboration suite 8.6.0 vulnerabilities and exploits

(subscribe to this query)

8.8

CVSSv3

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) prior to 8.6.0 Patch 10, 8.7.x prior to 8.7.11 Patch 2, and 8.8.x prior to 8.8.8 Patch 1 allows remote malicious users to hijack the authentication of unspecified victims by ...

Zimbra Zimbra Collaboration Suite 8.6.0 Synacor Zimbra Collaboration Suite 8.6.0 Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.7.11

5.3

CVSSv3

mailboxd in Zimbra Collaboration Suite 8.8 prior to 8.8.8; 8.7 prior to 8.7.11.Patch3; and 8.6 prior to 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump.

Synacor Zimbra Collaboration Suite 8.6.0 Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.7.11

5.3

CVSSv3

An issue exists in Synacor Zimbra Collaboration Suite 8.6.x prior to 8.6.0 Patch 11, 8.7.x prior to 8.7.11 Patch 6, 8.8.x prior to 8.8.8 Patch 9, and 8.8.9 prior to 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authenticati...

Synacor Zimbra Collaboration Suite 8.6.0 Synacor Zimbra Collaboration Suite 8.7.11 Synacor Zimbra Collaboration Suite 8.8.8 Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.8.9

1 Github repository

6.1

CVSSv3

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 prior to 8.7.11 Patch 7, and 8.8 prior to 8.8.10 Patch 2 has Persistent XSS.

Synacor Zimbra Collaboration Suite 8.8.9 Synacor Zimbra Collaboration Suite 8.7.11 Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.8.10 Synacor Zimbra Collaboration Suite 8.6.0

5.3

CVSSv3

mailboxd in Zimbra Collaboration Suite 8.8 prior to 8.8.8; 8.7 prior to 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.

Synacor Zimbra Collaboration Suite 8.6.0 Synacor Zimbra Collaboration Suite

1 Github repository

6.1

CVSSv3

Synacor Zimbra Mail Client 8.6 prior to 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.

Synacor Zimbra Collaboration Suite 8.6.0

6.5

CVSSv3

mailboxd in Zimbra Collaboration Suite 8.8 prior to 8.8.8; 8.7 prior to 8.7.11.Patch3; and 8.6 prior to 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.

Zimbra Zimbra Collaboration Suite 8.6 Zimbra Zimbra Collaboration Suite 8.7.11 Synacor Zimbra Collaboration Suite

6.5

CVSSv3

Unspecified vulnerability in Zimbra Collaboration prior to 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 102029.

Synacor Zimbra Collaboration Suite

8.8

CVSSv3

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration prior to 8.6.0 Patch 8 allow remote malicious users to hijack the authentication of administrators for requests that (1) add, (2) modify, or (3) remove accounts by leveraging f...

Synacor Zimbra Collaboration Suite

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook