zimbra collaboration 8.8.15 vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote malicious user to escalate privileges and obtain sensitive information via the password and 2FA parameters.

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an malicious user to execute arbitrary code via the sfdc_preauth.jsp component.

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue exists in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over...

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

1 Metasploit module4 Github repositories1 Article

9.8

CVSSv3

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal a...

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

10 Github repositories1 Article

9.8

CVSSv3

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue exists in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 prior to 8.8.15 Patch 23 and 9.x prior to 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not che...

Zimbra Collaboration Zimbra Collaboration 8.8.15 Zimbra Collaboration 9.0.0

9.8

CVSSv3

Zimbra Collaboration Suite (ZCS) prior to 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.8.15

9

CVSSv3

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated malicious user to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Zimbra Collaboration 8.8.15

8.8

CVSSv3

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.

Zimbra Collaboration 8.8.15

8

CVSSv3

Zimbra prior to 8.8.15 Patch 10 and 9.x prior to 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox ...

Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.8.15 Synacor Zimbra Collaboration Suite 9.0.0

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook